Deep Forestry AB safeguards your personal integrity
This Privacy Policy describes how Deep Forestry AB, Swedish corp. reg. no. 559169-9607,Bergsbrunnagatan 22, SE-753 23 Uppsala, Sweden, (the ”Company”) handles your personal data about you in your capacity asa(n)
(i) representative of a company that is an actual or potential customer, supplier, or partner;
(ii) shareholder or as a representative of a shareholder or as a holder or a representative of a holder of other financial instruments that can be converted to or that entitleto subscribe for shares in the Company (“Shareholder”);
(iii) visitor of the Company’s website;
(iv) person seeking employment with the Company; or
(v) person in the vicinity ofthe Company's drone operations.
This policy also provides information about your rights in relation tothe Company and how you can exercise them.
how we use personal data
Company representatives for e.g.customers, suppliers and partners
Managing the business relationship with company representatives
Purposes of processing. To be able to keep in touch with representatives of customers,suppliers, and partners (e.g. in connection with the provision of products orservices by or to the Company), including to ensure payment.
Categories of personal data. Personal information and contact information, such as name, address,telephone number, email address, title, position, and employer. Legal basis.The processing is necessary for the Company’s legitimate interest to keep in touch with representatives in order to (i) fulfil obligations or exercise rights related to the agreement with the customer or partner that there presentative represents, (ii) receive products or services pursuant to the agreement with the supplier that the representative represents (legitimate interest).Storage period. As long as the information is necessary in order for the Company to manage its business relationship with the company that the representative represents.
Fulfilment of legal requirements
Purposes of processing. To be able to fulfil legal requirements, e.g. accounting requirements.Categories of personal data. Personal information and contact information,such as name, address, telephone number, email address, title, position and employer. Legal basis. The processing is necessary for compliance with the Company’s legal obligations. Storage period. Seven years from theend of the calendar year to which the information pertained.
Carrying out surveys
Purposes of processing. To be able to carry out surveys regarding the customer experience andthe Company’s products and services. Categories of personal data. Personalinformation and contact information, such as name, address, telephone number,email address, title, position and employer. Legal basis. The processingis necessary for the Company’s legitimate interest in evaluating, developing,and improving its products, services, and marketing (legitimate interest). Storage period. The information is stored until the results are summarized and anyperiod thereafter that is necessary for the Company to demonstrate the validityof any claims made based on the results.
Marketing
Purposes of processing. To be able to market the Company's brand, products, and services (e.g.by sending newsletters and other marketing material, as well as invitations to Company events, etc.). Categories of personal data. Personal informationand contact information, such as name, address, telephone number, email address, title, position and employer. Where applicable, information regarding dietary preferences, potential allergies and/or disabilities (e.g. inconnection with corporate events or meetings). Legal basis. The processing is necessary for the Company’s legitimate interest in marketing itsproducts, services and brands to the customer, supplier, or partner that therepresentative represents (legitimate interest). If and to the extent that processing in connection with Company events includes personal data concerning allergies, disabilities or similar data (health data), suchprocessing is carried out on the basis of the representative’s consent. Storage period. Until the data subject objects to the marketing. In respect of personal data concerning allergies, disabilities or similar data, it will beerased within one month from the event or when the consent is withdrawn,whichever occurs earlier.
Complaints and warranty matters
Purposes of processing. To be able to respond to and compensate customers, suppliers, and partners in connection with complaints and warranty matters. Categories of personaldata. Personal information and contact information, such as name, address, telephone number, email address, title, position and employer. Where applicable, information regarding phone calls with the Company’s customerservice. Legal basis. The processing is necessary for the Company’s legitimate interest in ensuring the quality of its products and services aswell as to maintain its business relationships (legitimate interest). Storage period. One year after the expiration of the applicable warranty period.In respect of information regarding phone calls with the Company’s customerservice, one year or one year after the expiration of the applicable warrantyperiod, whichever occurs latest.
Product development and service quality improvement
Purposes of processing. To be able to improve the quality of the Company's products, services,marketing and customer service. Categories of personal data. This mayinclude: (i) Personal information and contact information (e.g., name, emailaddress, telephone number, title, position, and employer), (ii) Informationthat is provided to the Company by email, via the Company’s social media, or byother channels of communication, (iii) Product and service usage data (e.g.,information about which products or services the representative's company uses,purchase history, or service interaction logs), (iv) Technical data (e.g.,device information, software version, error logs, or diagnostic data), and (v)data related to phone calls with the Company’s customer service. Legal basis.The processing is necessary for the Company’s legitimate interest in (i) ensuringthe quality and efficiency of the Company's customer, and (ii) evaluating, developing, and improving its products, services, and marketing (legitimateinterest). Storage period. One year from the date of contact with the Company's customer service.
Automated notetaking in business meetings
Purposes of processing. Tofacilitate the documentation of business meetings through an optional AI-powered notetaking service. Categories of personal data. Name, voice, image (including video recordings), and statements made during the meeting, as well as any other personal datacommunicated during the meeting. Legal basis. The processing isnecessary for the Company's legitimate interest in ensuring accurate and efficient documentation of business meetings (legitimate interest). Transparency and opt-out. The AI notetaking service announces its presence throughvisual cues at the commencement of, and throughout, each meeting. Any meetingparticipant may request the removal of the AI notetaking service, and theCompany will comply with such request. Storage period. Meeting notes,including video recordings (if any), are retained for as long as they arenecessary for the Company's business purposes.
Potential customers, suppliers andpartners and company representatives for potential customers, suppliers andpartners
Marketing
Purposes of processing. To be able to market the Company's brand, products, and services (e.g.by sending newsletters and other marketing material, as well as invitations toCompany events, etc.). Categories of personal data. Contact information,such as name, address, telephone number, email address, and, where applicable,title, position and employer. Where applicable, information regardingdietary preferences, potential allergies and/or disabilities (e.g. inconnection with corporate events or meetings). Legal basis. Theprocessing is necessary for the Company’s legitimate interest in marketing itsproducts, services and brands to potential customers, suppliers, or partners(legitimate interest). If and to the extent that processing in connection withCompany events includes health data, such processing is carried out on thebasis of the data subject’s consent. Storage period. The Company doesnot have a set duration for marketing data. Instead, the Company regularlyassess whether your information is relevant for marketing purposes in theapplicable marketing efforts. Where data is processed on the basis of consent, thedata will be erased when the consent is withdrawn.
Shareholders
Fulfilment of obligations accordingto the articles of association
Purposes of processing. To fulfil the Company’s obligations to you as a Shareholder according tothe Company’s articles of association. Categories of personal data. Personalinformation and contact information, such as personal identification number,name, address, telephone number, email address, and position. Holdingsof shares or other financial instruments. Financial instruments, e.g.information regarding voting rights at general meetings of shareholders, shareholding and rights relating to the ownership. Where applicable,information regarding proxies representing Shareholders. Whereapplicable, information regarding trustees, pledges and pledgees, and othernotes in the share register. Other information that has been provided byyou or the organisation that you represent. Legal basis. The processingis necessary to fulfil the Company's contractual obligations to you inaccordance with the articles of association (performance of agreement). Regardingrepresentatives of Shareholders, the processing is necessary for the Company'slegitimate interest in fulfilling its contractual obligations towards itsShareholders (legitimate interest). Storage period. As long as the datasubject holds financial instruments in the Company, and five years thereafter.
Fulfilment of legal obligations
Purposes of processing. To fulfil the Company's obligations to you and other Shareholders inaccordance with the Swedish Companies Act or other applicable legislation. Categoriesof personal data. Personal information and contact information, such aspersonal identification number, name, address, telephone number, email address,and position. Holdings of shares or other financial instruments. Financialinstruments, e.g. information regarding voting rights at general meetings ofshareholders, shareholding and rights relating to the ownership. Whereapplicable, information regarding proxies representing Shareholders. Whereapplicable, information regarding trustees, pledges and pledgees, and othernotes in the share register. Other information that has been provided byyou or the organisation that you represent. Legal basis. The processingis necessary for compliance with the Company's legal obligations. Storage period. As long as the Company exists, or longer as required by law.
Distribution of information
Purposes of processing. Distribution of shareholder-related information. Categories ofpersonal data. Personal information and contact information, such aspersonal identification number, name, address, telephone number, email address,and position. Other information that has been provided by you or theorganisation that you represent. Legal basis. The processing isnecessary in order for the Company to be able to inform Shareholders and otherstakeholders in a timely and correct manner about information relevant to theCompany (legitimate interest). Storage period. As long as the datasubject holds financial instruments in the Company, or as long as otherwisenecessary in order to distribute shareholder-related information.
Visitors of the Company’s website
Website operation and development
Purposes of processing. To be able to ensure the operation of the Company's websites and theirapplication and to be able to develop the Company's websites and to betteradapt the websites based on how they are used. Categories of personal data. Technicaldata, such as IP address, MAC address, URL, unique device ID, network anddevice performance, browser, language and identification settings, geographiclocation, operating system, and other information from cookies or similarmechanisms (device information). Legal basis. The processing isnecessary for the Company’s legitimate interest in improving, streamlining,simplifying and developing its website and to increase the number of recurringvisitors (legitimate interest). Storage period. In accordance with theCompany's cookie policy.
Security
Purposes of processing. The processing is carried out for preventing security incidents andfraud. Categories of personal data. Technical data, such as IP address,MAC address, URL, unique device ID, network and device performance, browser,language and identification settings, geographic location, operating system,and other information from cookies or similar mechanisms (device information).Legal basis. The processing is necessary for the purposes of the Company’slegitimate interest in preventing security incidents and fraud and any legalclaims related thereto (legitimate interest). Storage period. One yearor such longer period as is deemed necessary, e.g. for investigating a securityincident and managing any legal claims thereto.
Persons in the vicinity of the Company's droneoperations
Drone camera footage
Purposes of processing. To carry out the Company's drone operations, during which persons in the vicinityof the drone may be incidentally captured on camera. Categories of personaldata. Images and video footage in which individuals may be identifiable(e.g. facial features, clothing, location, and physical appearance). Legalbasis. The processing is necessary for the Company's legitimate interest inconducting its drone operations for business purposes (legitimate interest).Safeguards. The Company applies blurring technology to anonymise anyidentifiable individuals captured in drone footage as soon as reasonablypracticable. Storage period. Identifiable personal data is only retaineduntil anonymised, which takes place when the footage is stored outside thedrone by the Company.
Recruitment (job applicants)
Evaluation of job applicants
Purposes of processing. Tobe able to evaluate job applicants and ensure that the job applicant has thenecessary qualifications. Categories of personal data. Personalinformation and contact information, such as name, address, telephone number,email address, title, position, and current employer. Information provided incover letter, resume, and any other documents that are submitted to theCompany. Where applicable, pictures. Other information that theapplicant provides to the Company in connection with the recruitment process. Legal basis. The processing is necessary for the Company’slegitimate interest in recruiting qualified employees (legitimate interest). Storage period. Until the recruitment process isover. If you are employed, we retain the application information for theduration of the employment. If you send in a spontaneous application, we keepyour information until our next recruitment phase if you have indicated thatyou have an interest in future opportunities at the Company.
All categories
Legal claims
Purposes of processing. The processing is carried out for the purpose of establishing,exercising and/or defending any legal claims. Categories of personal data. Anyinformation that the Company process for other purposes or collectsspecifically for the legal claim. Legal basis. The processing isnecessary for the purposes of the Company’s legitimate interest inestablishing, exercising or defending legal claims that arises (legitimateinterest). Storage period. For the applicable statute of limitations, whichgenerally means ten (10) years from the event giving rise to the claim.Personal data collected for recruitment purposes is stored for two (2) yearsafter the role you applied for was filled.
how we collect data
With respect to company representatives forcustomers, suppliers, and partners, and company representatives for potentialcustomers, suppliers, and partners, your personal data is usually collectedfrom the company or organisation that you represent, but also, in certaincases, directly from you, e.g. by email, our social media or other channels of communicationor in connection with events or meetings. The Company may also receive personaldata about you from other companies within the group that the Company is partof or from partners of the Company. The Company may also use externalinformation services to supplement existing data, e.g. with your position andcontact information.
With respect to visitors of the Company’s website,persons in the vicinity of the Company’s drone operations, and job applicants,your personal data may be provided to the Company directly from you, collectedincidentally through the Company's drone camera equipment, or from the staffingagency, recruitment company, or hiring company through which you apply forwork.The Company may also use external information services to supplement existingdata.
Withrespect to Shareholders your personal data may be provided to the Companydirectly from you or from the organization you represent. The Company may alsouse external information services to supplement existing data.
how we share data
The Company will only share personal data with third parties to the extentnecessary for the purposes described in this policy. This may include thefollowing disclosures:
· Disclosure of personal datawhen necessary to fulfil a legal obligation or to fulfil the Company'sobligations to you, customers and/or partners.
· Personal data may betransferred to other companies within the Company’s group, suppliers andsubcontractors (including suppliers of cloud solutions, IT service providers, hosting providers, and subcontractors engaged in the performance of the Company's services), payment service providers, insurance providers, partners,professional advisors (such as legal counsel, auditors, and accountants), authorities(including regulatory bodies).
· Personal data may betransferred to potential buyers or investors in connection with a potentialsale, merger, or other restructuring of the Company or its assets.
· With respect to informationthat is provided via the Company’s social media, personal data may be sharedwith the public.
Transfers of personal data to third countries
The company strives toprocess your personal data within the EU/EEA. If your personal data is transferred to acountry outside the EU/EEA, the Company will take the necessary measures toensure that the transfer of the personal data is legal and that your personaldata is processed securely and with an adequate level of protection that iscomparable to the protection offered within the EU/EEA.
Data collected on the Company’s website through Google Analytics, Microsoft Clarity, and HubSpot may be transferred to Google, Microsoft and HubSpot in the United States. Data collected with the Company’s automatednotetaker is transferred to the company Fathom in the United States. Yourpersonal data is then protected through these entities’ adherence to theEU-U.S. Data Privacy Framework. More information about the EU-U.S. Data PrivacyFramework is available at https://www.dataprivacyframework.gov/.
Social media
Regarding personal data that occurs and is processed on social media, such as Facebook,Instagram, X, Youtube and LinkedIn, we refer users to the policy provided bythe relevant service provider for information on how such service providerprocesses personal data. In the Company’s view, the purpose of the processingis that relevant stakeholders, and their representatives, shall be able tointeract and maintain contact with the Company via social media, in order tocontribute to good relationships with customers and partners and to make theCompany's customer service and products widely accessible through severaldifferent channels, and the processing is necessary to promote such legitimateinterests of the Company (legitimate interest).
Your rights
Below is a summary of your rights under data protection law. The websites of the EUsupervisory authorities can provide you with more detailed information on theserights.
· Right of access. You have the right to beinformed whether we are processing personal data concerning you and, if so, toreceive a copy of it together with additional information about the processing.
· Right to rectification. If the personal data weprocess about you is incorrect, incomplete or out of date, you have the rightto ask us to correct or supplement it without undue delay.
· Right to restriction of processing.In some cases, you have the right to require us to restrict the processing ofyour personal data. This is the case when (i) you believe that the personaldata is not accurate and you are awaiting our verification of the accuracy ofthe personal data, (ii) the processing is unlawful and instead of the personaldata being erased, you wish the processing to be restricted, (iii) we no longerneed the personal data, but you need it for legal claims, or (iv) when you haveobjected to a processing and you are waiting for verification of whether thereare compelling legitimate grounds to continue the processing.
· Right to erasure (right tobe forgotten).You have the right to request that we delete your personal data without unduedelay. We will delete your personal data if (i) the personal data is no longernecessary for the purposes for which it was processed, (ii) you withdraw yourconsent and there is no other legal basis for the processing, (iii) you haveobjected to the processing of your personal data for direct marketing purposes,or to processing that takes place on the basis of a balancing of interests as alegal basis and we cannot demonstrate compelling reasons for theprocessing, (iv) the personal data hasbeen unlawfully processed, or (v) the personal data must be erased in order tocomply with a legal obligation.
· Right to data portability. When personal data youhave provided to us is processed automatically and with your consent or on thebasis of an agreement with you as a legal basis, you have the right to receiveyour personal data in a commonly used and machine-readable format and totransfer the personal data to another data controller.
· Withdraw consent. If you have given us yourconsent for a specific activity, you have the right to withdraw your consent atany time. The withdrawal of consent does not affect the lawfulness ofprocessing based on consent before your withdrawal.
· Right to lodge a complaint. You have a right to lodgea complaint regarding our processing of your data with the Swedish Authorityfor Privacy Protection, Box 8114, SE-104 20 Stockholm, Sweden, or in the EU/EEAmember state of your habitual residence, place of work or of an allegedinfringement. The contact details for local national data protectionauthorities can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
The right to object
You have the right toobject at any time to the processing of personal data we support on the legalbasis of balancing of interests, including e.g. profiling. We will then ceaseprocessing unless (i) we have compelling legitimate grounds, or (ii) we processthe data for the establishment, exercise or defence of legal claims. Thelegitimate interests for our processing activities are stated under “Whatpersonal data does the company process, for which purposes, and on which legalbases?” above. If you want to know more about how we have done theseassessments, please contact us.
Cookies
The Company uses cookie-like techniques in order to provide certain functions on the Company’s website to improve the website and to deliver a better and morepersonal service. The Company uses cookies in accordance with the Company's Cookie Policy, available at https://www.deepforestry.com/cookie-policy.
If you do not share your personal data with the company
If you do not share yourpersonal data with the Company, the Company will not be able to fulfil itslegal or contractual obligations towards you or towards the company that yourepresent. For Shareholders, this means that you will not be able to exerciseyour rights as a Shareholder, including attending and voting at generalmeetings.
Changes
The Company reserves theright to change this Privacy Policy at any time. In the event of changes tothis Privacy Policy, the Company will publish the amended Privacy Policy on deepforestry.comwith information on when the changes will come into effect and may also notifycustomers and partners in an appropriate manner.
Contact information
Do not hesitate to contact the Company if youhave any questions about this Privacy Policy, the processing of your personal data or if you wish to exercise your rights under this Privacy Policy orapplicable legislation.
Deep Forestry AB
Swedish company reg. no. 559169-9607
Bergsbrunnagatan22
SE-75323 Uppsala
info@deepforestry.com
