Privacy policy

We at Upsales Nordic AB (”Upsales”, “we”, ”our” och ”us”) care about your privacy and want you to feel safe when we process your personal data.

In this privacy policy we want to inform you who interact with us in different situations about how we process your personal data. The policy does not describe how we process the personal data that your company is storing in Upsales’ products. Your company is the responsible controller of such data and Upsales processes it in accordance with our Data Processing Agreement with your company.

This privacy policy applies to:

You that are a representative of our current or potential customer, supplier or partner or that interact with us without having a business relationship with us;
You who visit our website or communicate with us on social media;
You that subscribe to our newsletters;
You that participate in one of our events or webinars;
You that apply to or participate in our Executive Network; and
You that have a question, complaint or claim.

We mainly process your personal data within the EU/EEA. When we use certain third-party services, we will transfer your personal data outside of the EU/EEA to our suppliers that are located there. Such transfer only takes place when we can ensure an appropriate level of protection of your personal data.

Below you can find detailed information on how and why we process your personal data, the legal basis for processing and the storage period for which we keep your personal data. The information also describes your rights.

In short: Why do we do process your personal data?

If you interact with us without having a business relationship with us, represent a business lead or visit our social media, we process your personal data to communicate with you and enable your company to try Upsales
If you visit our website, we process your personal data to analyse how you use the website and show you relevant marketing on social media and other websites you visit
If you represent our customer, your personal data will be processed to enter into an agreement with your company and administrate our relationship, send newsletters, handle your feedback and improve our business and services, and provide customer service
If you represent our supplier or partner, we process your personal data to enter into an agreement with your company and administrate our relationship
If you subscribe to our newsletters, your personal data will be processed to send newsletters to you and analyse how our newsletters are used to improve and develop them
If you participate in one of our events or webinars, we process your personal data to enable you to take part in the event or webinar and make use of footage from such event or webinar
If you apply to or participate in our Executive Network, we process your personal data to handle your application, manage the network and send exclusive newsletters
If you have a complaint or claim, we process your personal data to handle the complaint or claim
To make the website and service function and remember your choices, we process your personal data, such as technical information regarding your device and information about your choices

Depending on the relationship we have with you, we process your personal data for all or only some of the above stated purposes. A detailed description of our processing of your personal data is provided in the charts below.

Your rights

In short you have the following rights:

Below you can read more about:

By clicking on the links below you can read more about how we process your personal data.

Upsales is responsible for processing of your personal data 3

From where do we collect your personal data? 3

The personal data you need to provide to us 3

Who can gain access to your personal data and why? 4

Where are your personal data processed? 5

Detailed description on how we process your personal data 6

What are your rights when we process your personal data? 16

Balancing of interests assessments when processing personal data based on the legal basis “legitimate interests” 20

When we refer to “your company” in this privacy policy, we refer to your employer or the organisation that you represent. We will only process data about you in your business role, which, for example means that we will only send marketing to your company and not to you in your capacity as a private individual.

Upsales is responsible for processing of your personal data

Upsales Nordic AB (Swedish registration number 556641-2507), is responsible for the processing of your personal data.

Should you have any questions regarding our processing of your personal data, or if you wish to exercise any of your rights under data protection legislation, please contact us via our e-mail address info@upsales.com, or through post to our Swedish office (the address can be found at the website).

From where do we collect your personal data?

We collect your personal data directly from you, for example when you contact us and when you use our website or services we will gather information from your device (e.g. smartphone or computer). We may also collect your personal data from your company, if they state you as their representative. We will also collect your personal data from other sources as specified in the detailed information below.

The personal data you need to provide to us

In general, you are not required to provide your personal data to us. You find a description of when you are needed to provide your personal data in the charts below when the so-called legal basis is stated to be a ”Legal obligation”. If you don’t provide such personal data to us, we at Upsales will not be able to administrate our relationship with your company or fulfil the agreements with your company.

Who can gain access to your personal data and why?

Your personal data is initially collected and processed by us and we don't sell your personal data. This means that your personal data will be handled by our employees, but only by personnel who need such access to conduct their work.

To conduct our business, we need to work with suppliers and partners who will process your personal data. We are responsible for sharing your personal data with such suppliers or partners and ensuring your personal data is safe when shared with third parties, as set out below.

In the below charts, we have described in detail how we share your personal in the specific case and which personal data is shared. Here, you will find a summary of the external parties we use and how:

We will share your personal data with our IT partners, who will process these on our behalf and on our instructions to ensure sound and secure IT operations. We only share your personal data with our IT partners if it's necessary for them to fulfil their obligations towards us according to our contract with them.
We use third parties which, on our behalf and our instructions, help us administrate our marketing and, therefore, will have access to your personal data.
If you interact with us on or visit our social media accounts, the social media platform you use will process personal data about you as a user.
To store information that we, according to bookkeeping and accounting law, are required to store, we may use a company that helps us archive such information. The information contains personal data but will only be processed on our behalf and on our instructions.
When you use our website and consent to us doing so, we will also share your personal data with:
- The companies with provides analytic services, such as Google, which provides a service to analyse the website; and
- The companies which provide the marketing services we use e.g. Google (including YouTube), Meta (Facebook and Instagram), X (previously Twitter) and/or LinkedIn).

You find a list of the suppliers used at our website in our information about cookies.

If you as a representative use our service, we will share your personal data with the supplier of the feedback service we use.
If you participate in any of our events, we will share your personal data with:
- The photographer that takes your picture will gain access to your personal data and will process your personal data on our behalf and our instructions;
- Social media platforms, if we publish a picture or video in which you appear. These social media platforms are either processing your personal data on our instructions or as controllers in their own right for their processing of your personal data. Their role in a particular case depends on the specific platform and activity;
- Our partner if we arrange the event in collaboration with the partner; and
- Other participants and partners of the event, if you participate in certain events arranged for our Executive Network.

If you have any questions regarding how we share your personal data or want to know more about who we share your personal data with, please feel free to contact us.

Where are your personal data processed?

We mainly process your personal data within the EU/EEA. In some instances, we will transfer your personal data outside of the EU/EEA to our IT suppliers that process personal data as our data processors and according to our instructions. Such transfer only takes place in accordance with applicable data protection legislation meaning that we will transfer your personal data outside the EU/EEA when we can ensure an appropriate level of protection of your personal data.

We will transfer your personal data in the following ways:

If you use our website and have consented to us using analytic- and marketing services from Google, Meta (Facebook and Instagram), X (previously Twitter) and LinkedIn, your personal data may be considered transferred outside of the EU/EEA. These parties may transfer your personal data to the United States since they are located there. We have anonymised your personal data as far as possible to avoid your personal data being transferred outside of the EU/EEA.
If you use our service, we will transfer your personal data outside the EU/EEA, to the United States, since the supplier of the analytic feedback service we use is located there. We process a pseudonymised user ID and account ID to limit our processing as far as possible.
We will transfer your personal data outside the EU/EEA, to the United States, when we remember whether you have given your consent since our cookie management provider Cookiebot uses suppliers with databases within the United States.

When we use services from Google, Meta, X (previously Twitter), LinkedIn, Cookiebot and our feedback service supplier, we and our suppliers rely on an adequacy decision regarding the United States recognised by the European Commission for transferring personal data outside of the EU/EEA. This means that the European Commission has assessed that a particular country has an adequate level of protection for your personal data under Article 45 GDPR. This decision between the EU and the USA is called the EU-US Data Privacy Framework. These companies are certified under the EU-US Data Privacy Framework.

When US companies are not certified under the EU-US Data Privacy Framework, we can't rely on the adequacy decision for transfers to the United States. Then we will transfer your personal data under the Standard Contractual Clauses (Article 46.2 (c) GDPR) together with supplementary measures. You can find the Standard Contractual Clauses here. We have implemented additional safeguards to ensure that your personal data is protected, for example, we have minimized the information these external parties get access to, and we always try to avoid sharing your personal data in clear text with such third parties.

If you want to know more about the additional safeguards we have implemented to protect your personal data, please feel free to contact us.

A detailed description of how we process your personal data

The below charts describe in detail why we process your personal data, what personal data we process, when you need to provide the personal data to us and the legal basis for our processing. The legal basis is the basis for processing your personal data according to the GDPR. You will also find information about how long we process your personal data.

You can also click on the links below if you want to read about how we process your personal data depending on what relationship you have with us:

Don’t hesitate to contact us if you have any questions regarding our processing of your personal data.

If you interact with us without having a business relationship with us, represent a business lead or visit our social media

If you represent a potential customer, supplier or partner (i.e. a business lead) to Upsales, we collect your personal data from you or your company, the internet or a third-party service. If you are in contact with us without having a business relationship with us, for example by sending us an e-mail or a message on our social media account, we will process your personal data as we describe in the charts below. We process the personal data you provide us and information from your social media account (if you use such an account to communicate).

When contacting us through a social media platform, we suggest you also familiarise yourself with the privacy information of that platform.

To communicate with you
What processing we perform	What personal data we process	Our legal basis for the processing
Communicate, e.g. via e-mail Communicate via social media, e.g. if you comment on our site or our wall Give you a call if you have left your phone number on our website Answer your questions and give you the best service	Information you provide to us, e.g. name and contact information If you visit our social media accounts (e.g. our Instagram) we also process: Information from your profile on the social media in question (user name and any picture you have chosen for your account) Other information regarding the matter for which you contact us	Legitimate interest (Article 6.1 (f) GDPR) The personal data will be processed based on our legitimate interest in communicating with you who have contacted us.
Storage period: We will delete your personal data regularly and as described below: Communication with us via our websites or in e-mails will be stored for a period of three months after the matter for which you have contacted us has been resolved, in order for us to give you the best service. Your comments and communication with us on social media can be deleted by you at any time. We will remove posts or comments which are in breach of the rules of the platform or in conflict with legislation as soon as possible. If we find that your company is a business lead after we have had contact with you, we will store your personal data for six months.
Recipients: When you interact with us on our social media account, the social media platform that you use will process personal data about you as a user. These social media platforms will continue to process your personal data as independent controllers. Information about how long they store your personal data can be found in their respective privacy information. We will also share your personal data with our IT-partners.
Transfer outside EU/EEA: We will not transfer your personal data for this specific purpose. However, the suppliers of the social media platform that you use will be able to access and process your personal data as independent controllers from outside the EU/EEA. You can read more about this in their respective privacy information.

To enable your company to try Upsales
What processing we perform	What personal data we process	Our legal basis for the processing
Enable you to sign up for a free trial of Upsales Contact you if we find that your company is a business lead	Information you provide to us when signing up (name, e-mail, company belonging, password and telephone number)	Legitimate interest (Article 6.1 (f) GDPR) The personal data will be processed based on our legitimate interest to facilitate our free trial of Upsales and enable your company to try Upsales.
Storage period: We will delete your personal data when the free trial period has ended, i.e. after 14 days. If we find that your company is a business lead, we will store your personal data for six months.
Recipients: We will share your personal data with our IT partners.
Transfer outside EU/EEA: We will not transfer your personal data for this specific purpose.

The chart below describes how we process your personal data if you subscribe to our newsletters. We gather your personal data directly from you and provide some personal data ourselves by analysing how you use our newsletters.

To send newsletters
What processing we perform	What personal data we process	Our legal basis for the processing
Send information about news, marketing, offers and invitations (“newsletters”) to you who have chosen to subscribe to our newsletters	E-mail address	Legitimate interest (Article 6.1 (f) GDPR) The personal data will be processed based on our legitimate interest in sending the newsletters you have stated that you wish to receive.
Improve and develop our newsletters by analysing how you open them and what you click on in the newsletters Do you want to read more about this type of analysis? You can find a more detailed description of this in our information about cookies.	Information about how you open our newsletters and what you click on IP-address E-mail address	Consent (Article 6.1 (a) GDPR) The personal data will be processed based on your consent. You have the right to withdraw your consent at any time by contacting us. Your withdrawal of consent shall not affect the lawfulness of the processing before its withdrawal.
Storage period: You can choose to unsubscribe or object to receiving newsletters and marketing at any time. If you object to receiving marketing from us, we keep track of this in our “unsubscribe-list” to avoid sending you any further marketing material.
Recipients: We use third parties which on our behalf and on our instructions, help us administrate our marketing and, therefore, will have access to your personal data. We will also share your personal data with our IT partners.
Transfer outside EU/EEA: We will not transfer your personal data for this specific purpose.

If you visit our website

We analyse how our website is used and show you relevant marketing on social media and other websites you visit based on such analysis. This means that your personal data is processed when you visit our website. To protect your privacy, we have taken measures to avoid identifying you when you visit our website. For instance, we only store an encrypted version of your IP address to reduce the risk of being able to identify you.

When you visit our website, we will gather your personal data from your device and from the companies we cooperate with (see below) and using our own Upsales Marketing Automation tool. Such companies will also use previous information they have about you to show you interesting offers.

When you use our website, we will gather personal data by using cookies. Our text about cookies describes how we do this, which you find here.

To analyse how our website is used
What processing we perform	What personal data we process	Our legal basis for the processing
Analyse how you use our website to improve our website and services. To do this, we use analytic services, such as our own analytic service and the analytic service from Google Analytics The analytic service means that we place a random ID on your device to distinguish your device from other visitors and to acknowledge patterns in how our website is used. We will, however not know who you are The personal data we gather will be used, e.g. to optimise functions and to adapt the websites to suit our visitors Do you want to read more about how we use cookies? You find a more detailed description of this in our information about cookies.	An encrypted version of your IP address, which we at Upsales can’t connect to you as an individual Information about your device/browser (which area in the country you use our website from and which screen resolution you have) Information about your activities on the website Other information Google has about you, e.g. information about from which site you found us	Consent (Article 6.1 (a) GDPR) We will only process your personal data for this purpose if you consent. You can prevent Google Analytics from using your personal data by downloading and installing this browser add-on. You have the right to withdraw your consent at any time by contacting us. Your withdrawal of consent shall not affect the lawfulness of the processing before its withdrawal.
Storage period: We will store your personal data for a period of six months after your visit on our website. The suppliers of the analytic services we use may continue to store your personal data for their own purposes. E.g. Google will continue to store your personal data for their own purposes and Google will inform you separately about such storing.
Recipients: If you consent, we will share your personal data with the suppliers of the analytic services we use to analyse the website, such as Google. We will also share your personal data with our IT partners.
Transfer outside EU/EEA: Your personal data will be transferred to the United States when you use our website and have consented to us using analytic services from Google. Your personal data will be transferred outside the EU/EEA based on an adequacy decision regarding the United States recognised by the European Commission (the EU-US Data Privacy Framework). You can find Google’s certification here, by e.g. searching for the company.

To show you relevant marketing from us

What processing we perform

What personal data we process

Our legal basis for the processing

Market our services by showing you offers we believe you or your company are interested in

We show you such marketing on e.g. Google (including YouTube), Facebook (including Instagram), X (previously Twitter) and/or LinkedIn. You see marketing based on information that these companies have about you beforehand (so called profiling*)

Share information about you with e.g. Google (including YouTube), Meta (Facebook and Instagram), X (previously Twitter) and/or LinkedIn so that these marketing services will have information about which type of visitors that are interested in us

Do you want to read more about how we use cookies? You find a more detailed description of this in our information about cookies.

An encrypted version of your IP address, which we at Upsales can’t connect to you as an individual

Thereafter you will see search results and ads based on:

An analysis of how you use our website
Information that the marketing services we use have about you from before, e.g. information about from which site you found us

Consent (Article 6.1 (a) GDPR)

We will only process your personal data for this purpose if you consent.

Here you can make choices about the marketing you see from Google and here on Facebook, under the heading “Ad settings”, you can choose which marketing you want to see on Facebook.

You have the right to withdraw your consent at any time by contacting us. Your withdrawal of consent shall not affect the lawfulness of the processing before its withdrawal.

Storage period: You will see marketing from us on other websites and on social media for a period of six months after your visit to our website.

Google (including YouTube), Meta (Facebook and Instagram), X (previously Twitter) and/or LinkedIn will continue to process your personal data and will be independently responsible. Information on how long they store your personal data can be found in their respective privacy information.

Recipients: If you consent, we will share your personal data with Google, Meta, X (previously Twitter) and/or LinkedIn, which provide the marketing services we use.

We will also share your personal data with our IT partners.

Transfer outside EU/EEA: Your personal data will be transferred to the United States when you consent to receiving relevant marketing from us.

When we use marketing services from e.g. Google, Meta, LinkedIn and X (previously Twitter), your personal data will be transferred outside the EU/EEA, to the United States, based on an adequacy decision regarding the United States recognised by the European Commission (the EU-US Data Privacy Framework). You can find the certification for each company here, by e.g. searching for the relevant company.

* Profiling: We use so called profiling to be able to show you offers that are relevant to you and to provide you with customized marketing. We use profiling because, without it, you would instead see offers and information which you are probably not interested in. You have the right to object to profiling as described below under the section explaining your rights.

If you represent our customer

To enter into an agreement with your company and administrate our relationship
What processing we perform	What personal data we process	Our legal basis for the processing
Negotiate and enter into an agreement with your company Administrate our relationship with your company (e.g. communicate with our customer)	Information you provide to us, e.g. name, organisational belonging, position in your company, telephone number and e-mail address	Legitimate interest (Article 6.1 (f) GDPR) The personal data will be processed based on our legitimate interest to negotiate and enter into an agreement with your company and to administrate the agreement.
Storage period: Your personal data will be removed if we conclude that we will not enter into an agreement with your company. If your company becomes our customer, we will store your personal data for this purpose as long as your company is our customer, however for a shorter period if we receive information that you no longer represent the company.
Recipients: We will share your personal data with our IT-partners.
Transfer outside EU/EEA: We will not transfer your personal data for this specific purpose.

To send newsletters
What processing we perform	What personal data we process	Our legal basis for the processing
Send information about news, marketing, offers and invitations (“newsletters”)	E-mail address	Legitimate interest (Article 6.1 (f) GDPR) The personal data will be processed based on our legitimate interest to send newsletters to our customer.
Improve and develop our newsletters by analysing how you open them and what you click on in the newsletters Do you want to read more about this type of analysis? You find a more detailed description of this in our information about cookies.	Information about how you open our newsletters and what you click on IP-address E-mail address	Consent (Article 6.1 (a) GDPR) We will only process your personal data for this purpose if you consent. You have the right to withdraw your consent at any time by contacting us. Your withdrawal of consent shall not affect the lawfulness of the processing before its withdrawal.
Storage period: We will process your personal data as long as your company is our customer, however for a shorter period if we receive information that you no longer represent the company. You can choose to unsubscribe or object to receiving newsletters and marketing at any time. If you object to receiving marketing from us, we keep track of this in our “unsubscribe-list” to avoid sending you any further marketing material.
Recipients: We use third parties which on our behalf and on our instructions help us administrate our marketing and therefore will have access to your personal data. We will also share your personal data with our IT-partners.
Transfer outside EU/EEA: We will not transfer your personal data for this specific purpose.

To provide customer service and enable our login service
What processing we perform	What personal data we process	Our legal basis for the processing
Provide you with relevant information and communicate with you as a representative of our customer Administrate support matters Enable you as a representative of our customer to login to Upsales. To do this we use cookies that collect certain information about your device Do you want to read more about this type of analysis? You find a more detailed description of this in our information about cookies. Your organisation is responsible (data controller) for information that you register in Upsales.	Name, organisational belonging, position in your company, telephone number, e-mail address Information about the support matter E-mail address, password and technical information regarding your login	Legitimate interest (Article 6.1 (f) GDPR) The personal data will be processed based on our legitimate interest to provide customer service and enable our login service.
Storage period: We will process your personal data related to support matters as long as your company is our customer, however for a shorter period if we receive information that you no longer represent our customer. Your personal data will only be processed for this purpose if it's necessary for us to be able to provide continued service and view previous support matters in relation to our customer. We will process your account information to our login service for as long as your company is our customer, however for a shorter period if we receive information that you no longer represent our customer.
Recipients: We will share your personal data with our IT-partners.
Transfer outside EU/EEA: We will not transfer your personal data for this specific purpose.

To handle your feedback and improve our business and services
What processing we perform	What personal data we process	Our legal basis for the processing
Request your feedback Collect and analyse your feedback Analyse how you use Upsales to improve Upsales and our services. To do this we use an analytic service, including cookies or similar technology, from our feedback service provider The personal data we gather will be used e.g. to optimize functions in Upsales Do you want to read more about how we use cookies? You find a more detailed description of this in our information about cookies. Your organisation is responsible (data controller) for information that you register in Upsales.	A pseudonymised user ID and account ID Information you provide in your feedback. We recommend you not to share any personal information in your feedback. Information about your activities when you use Upsales	Legitimate interest (Article 6.1 (f) GDPR) The personal data will be processed based on our legitimate interest to be able to collect and evaluate your feedback and for us to improve our business.
Storage period: We will store information from your answers when you provide the feedback as long as the company you represent is our customer.
Recipients: We will share your personal data with our IT-partners including the provider of the feedback service we use.
Transfer outside EU/EEA: Your personal data will be transferred to the United States since the supplier that provides us with the feedback service is located there. Your personal data will be transferred outside the EU/EEA, to the United States, based on an adequacy decision regarding the United States recognised by the European Commission (the EU-US Data Privacy Framework).

If you represent our supplier or partner

To enter into an agreement with your company and administrate our relationship
What processing we perform	What personal data we process	Our legal basis for the processing
Negotiate and enter into an agreement with your company Administrate our relationship with your company (e.g. communicate with our supplier or partner)	Name, organisational belonging, position in your company, telephone number and e-mail address	Legitimate interest (Article 6.1 (f) GDPR) The personal data will be processed based on our legitimate interest to negotiate and enter into an agreement with your company and to administrate the agreement.
Storage period: Your personal data will be removed if we conclude that we will not enter into an agreement with your company. If your company becomes our supplier or partner, we will store your personal data for this purpose as long as the company you represent is our supplier or partner, however for a shorter period if we receive information that you no longer represent the company.
Recipients: We will share your personal data with our IT-partners.
Transfer outside EU/EEA: We will not transfer your personal data for this specific purpose.

If you participate in any of our events or webinars

To arrange events and webinars
What processing we perform	What personal data we process	Our legal basis for the processing
Administrate your registration to one of our events or webinars (“event”) Communicate with you before and during the event Send requests to participate in evaluations after the event and administrate the answers you provide in the evaluation and compile statistics of the results of our evaluations	Name, organisational belonging, position in your company, telephone number and e-mail address Dietary preferences (if applicable) Information you provide in an evaluation (if applicable)	Legitimate interest (Article 6.1 (f) GDPR) The personal data will be processed based on our legitimate interest to be able to arrange events. Consent (Article 6.1 (a) and 9.2 (a) GDPR) If we process sensitive personal data such as information about your allergies, we will obtain your explicit consent. You have the right to withdraw your consent at any time by contacting us. Your withdrawal of consent shall not affect the lawfulness of the processing before its withdrawal.
Some events and webinars are arranged by us in collaboration with a partner who will also process your personal data. You will be given information on who that partner is and where you can find their privacy information when you register for such an event or webinar.
Storage period: Your personal data will be stored until the event is completed. However, a participant list that you are part of will be saved in order for us to be able to follow up your participation in the event and invite you to similar events. We will remove your personal data if you ask us to do so. In cases where we have sent an evaluation to you after an event, to which you responded, we will store the result of the evaluation for six months after you have answered it. We will stop sending evaluations if you object to receiving them.
Recipients: If you participate in one of our events, we will share your personal data with our partner if the event is arranged by us in collaboration with the partner. We will also share your personal data with our IT-partners.
Transfer outside EU/EEA: We will not transfer your personal data for this specific purpose.

To take photos/videos during an event and publish them on our website and social media
What processing we perform	What personal data we process	Our legal basis for the processing
Take photos of you during an event Publish your photo on our intranet, our website or on our social media pages to be able to market our events Your personal data will only be processed for this purpose after you have been given information about our publication of photos and if you have not objected to our processing.	Your image, either in photos or video material	Legitimate interest (Article 6.1 (f) GDPR) The personal data will be processed based on our legitimate interest to be able to document our events and make us of footage from the event for marketing purposes. Consent (Article 6.1 (a) GDPR) In cases where we want to process footage where you are clearly depicted, we will obtain your consent. You have the right to withdraw your consent at any time by contacting us. Your withdrawal of consent shall not affect the lawfulness of the processing before its withdrawal.
Storage period: If we have published a photo or video of you from our event on our intranet or website, the photo or video will stay published for two years, unless you ask us to remove it before then. Photos or videos of you that have been published on our social media pages will be published until you ask us to remove them.
Recipients: If we take your photo during an event, the photographer that takes your picture will gain access to your personal data and will process your personal data on our behalf and on our instructions. If we publish a photo or video in which you appear on our social media platforms these social media platforms are either processing your personal data on our instructions or as controllers in their own right for their processing of your personal data. What role they have in a particular case depends on the specific platform and activity.
Transfer outside EU/EEA: We will not transfer your personal data for this specific purpose. However, the suppliers of the social media platform where we publish your picture or video will be able to access and process your personal data from outside the EU/EEA. You can read more about this in their respective privacy information.

If you apply to or participate in our Executive Network

We process personal data about the applicants and members of our Executive Network as described below. We collect your personal data from you, or from another member, if such member recommends you to us as a potential member.

To handle your application and manage the network
What processing we perform	What personal data we process	Our legal basis for the processing
Handle your application Contact or communicate with you as a member or potential member Invite you to participate in surveys Enable you to download relevant reports Invite you to exclusive events If you choose to participate in one of our events, please read about how we process your personal data in connection with events above. If you communicate with us on social media, please read more here.	Name, organisational belonging, position at your company, telephone number, e-mail address Other information about your record of achievement that you choose to share with us Spoken language Information about whether you were accepted to the network or not Date of application Information you provide in our surveys	Legitimate interest (Article 6.1 (f) GDPR) The personal data is processed based on our legitimate interest to handle your application and manage the network.
Storage period: If you are accepted as a member, we will store your personal data as long as you are a member to the network. If you are not accepted as a member, we will store your personal data for 6 months after your application was declined.
Recipients: We will share your personal data with our IT-partners. For certain events arranged for the network, we will also share your personal data with other participants and partners to such event.
Transfer outside EU/EEA: We will not transfer your personal data for this specific purpose.

To send newsletters
What processing we perform	What personal data we process	Our legal basis for the processing
Send information about news, marketing, offers and invitations (“newsletters”) to members	E-mail address	Legitimate interest (Article 6.1 (f) GDPR) The personal data will be processed based on our legitimate interest in sending the newsletters to members.
Improve and develop our newsletters by analysing how you open them and what you click on in the newsletters Do you want to read more about this type of analysis? You can find a more detailed description of this in our information about cookies.	Information about how you open our newsletters and what you click on IP-address E-mail address	Consent (Article 6.1 (a) GDPR) The personal data will be processed based on your consent. You have the right to withdraw your consent at any time by contacting us. Your withdrawal of consent shall not affect the lawfulness of the processing before its withdrawal.
Storage period: You can choose to unsubscribe or object to receiving newsletters and marketing at any time. If you object to receiving marketing from us, we keep track of this in our “unsubscribe-list” to avoid sending you any further marketing material.
Recipients: We use third parties which on our behalf and on our instructions, help us administrate our marketing and, therefore, will have access to your personal data. We will also share your personal data with our IT partners.
Transfer outside EU/EEA: We will not transfer your personal data for this specific purpose.

If you or your company have any questions or queries

We always strive to keep a good relationship to your company and answer all questions you or your company may have. If you or your company have any questions, would want to make a complaint regarding one of our services or if we would have a claim against your company, we will process your personal data as described below. We will collect your personal data from you or your company or provide the information ourselves.

Note that the ongoing matter may mean that we cannot delete all your personal data after your request.

To handle any questions, complaints or claims
What processing we perform	What personal data we process	Our legal basis for the processing
Handle any questions, complaints or claims To defend ourselves against claims and complaints To initiate any claims	Name, organisational belonging, position at your company, telephone number, e-mail address and information concerning your company’s complaint or claim	Legitimate interest (Article 6.1 (f) GDPR) The personal data is processed based on our legitimate interest to handle a question, complaint and/or legal dispute in which you are the representative of a customer, supplier or partner
Storage period: We will store your personal data from the time the matter was initiated and for the duration of the potential dispute.
Recipients: We will share your personal data with our IT-partners.
Transfer outside EU/EEA: We will not transfer your personal data for this specific purpose.

To comply with our bookkeeping and accounting obligations

To comply with bookkeeping and accounting legislation
What processing we perform	What personal data we process	Our legal basis for the processing
Store information in bookkeeping and accounting	Name, history regarding payments made and other information that constitutes accounting records	Legal obligation (Article 6.1 (c) GDPR) The processing is necessary to comply with legal obligations to which we are subject, i.e. bookkeeping and accounting legislation. You need to provide the personal data to us. Otherwise, we cannot comply with our legal obligations.
Storage period: We will store any document constituting bookkeeping material and personal data included therein for seven to eight years according to bookkeeping and accounting legislation. The regulation means that we store bookkeeping material until and including the seventh year after the end of the calendar year for the fiscal year to which the personal data relates.
Recipients: In order to store information that we according to bookkeeping and accounting law are required to store, we may use a company that help us archive such information.
Transfer outside EU/EEA: We will not transfer your personal data for this specific purpose.

If you object to receiving marketing from us

We will store information about you who have chosen to object to receiving marketing from us – see the below chart for information about this. We have received the personal data we store from you.

To comply with marketing legislation
What processing we perform	What personal data we process	Our legal basis for the processing
If you have stated that you do not wish to receive marketing from us, we will store such information in an “unsubscribe-list” to make sure we do not send any marketing to you	Name E-mail address	Legal obligation (Article 6.1 (c) GDPR) The processing is necessary to comply with legal obligations which we are subject to, i.e. marketing law which require us to not send marketing material to individuals who have objected to receiving such marketing. We cannot make sure you will not receive marketing from us without processing your personal data for this purpose and you are therefore required to provide your personal data to us. You need to provide the personal data to us. Otherwise, we cannot ensure that you will not receive any more marketing from us.
Storage period: You will be listed in our “unsubscribe-list” until further notice.
Recipients: We will share your personal data with our IT-partners.
Transfer outside EU/EEA: We will not transfer your personal data for this specific purpose.

To make the website and service function and remember your choices

When you visit our website our use our service, we process your personal data to make the website and service technically function and to remember your choices. We collect your personal data from your device (e.g. smartphone or computer) when you visit our website or use our service.

To provide a functioning website and service
What processing we perform	What personal data we process	Our legal basis for the processing
Make sure that our website and service functions in a satisfying and secure manner and adapt the website and service to your device. To do this we use cookies that collect personal data regarding your device Do you want to read more about how we use cookies? You find a more detailed description of this in our information about cookies.	Information about your device, e.g. type of device such as smartphone or computer	Legitimate interest (Article 6.1 (f) GDPR) The personal data is processed based on our legitimate interest to provide a functioning website and service.
Storage period: The personal data collected for the website and service's functionality will be stored until you close your browser or service.
Recipients: We will share your personal data with our IT-partners.
Transfer outside EU/EEA: We will not transfer your personal data for this specific purpose.
To remember your choices and adapt the website to suit you
What processing we perform	What personal data we process	Our legal basis for the processing
Remember your choices and adapt the website to suit you. To do this we use cookies that saves such information Do you want to read more about how we use cookies? You find a more detailed description of this in our information about cookies.	Information about your choices, e.g. which language version of the website you want to see and whether you have given your consent	Legitimate interest (Article 6.1 (f) GDPR) The personal data is processed based on our legitimate interest to remember your choices and adapt the website to suit you.
Storage period: The personal data collected using cookies to remember whether you have given your consent will stop being used at the latest one (1) year after your choice, after which we will ask again. The personal data collected using cookies to remember your preferred language version of the website will stop being used at the latest 400 days after your choice, after which we will ask again.
Recipients: To keep track of whether you have given your consent or not we share your personal data with Cookiebot, who provides the service we use to keep track of consents. We will also share your personal data with our IT-partners.
Transfer outside EU/EEA: In order for us to remember whether you have chosen to consent, your personal data will be transferred outside the EU/EEA, to the United States, based on an adequacy decision regarding the United States recognised by the European Commission (the EU-US Data Privacy Framework), since Cookiebot uses suppliers with databases within the United States.

What are your rights when we process your personal data?

You have certain rights that you can exercise to affect how we process your personal data. You can read about what those rights are below.

If you want to know more about your rights or if you want to exercise any of your rights, please contact us and we will help you. Our contact information can be found at the beginning of this privacy policy.

Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

You always have the right to lodge a complaint with a supervisory authority.

The supervisory authority in Sweden is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, the IMY).

In detail: Your right to complain exists without prejudice to any other administrative or judicial remedy. You have the right to lodge a complaint with a supervisory authority, in particular, in the EU/EEA member state where you live, work or place where the alleged infringement of applicable data protection laws has allegedly occurred.

The supervisory authority has an obligation of informing you on the progress and the outcome of the complaint, including the possibility of a judicial remedy.

Right to withdraw your consent (Article 7.3 GDPR)

You have a right to withdraw any consent you have given us, partly or completely, at any time by contacting us.

In detail. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right to object (Article 21 GDPR)

You always have a right to object to our processing of your personal data.

In detail: Your right to object applies as follows:

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on the legal basis “legitimate interest”, including profiling based on this provision. We shall no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, such as sending newsletters and customising marketing, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing. You can read more about profiling in the charts above.
Where you object to processing for direct marketing purposes, you have an unconditional right to have the processing of your personal data for such purposes ceased.
In the context of the use of information society services, and regardless of Directive 2002/58/EC (ePrivacy Directive, or ePD), you may exercise your right to object by automated means using technical specifications.

Right of access (Article 15 GDPR)

You have the right to obtain confirmation as to whether we are processing personal data about you or not. You can make a request by contacting us. If we do process your personal data, you also have a right to obtain a copy of the personal data processed by us as well as information about how we process your personal data.

In detail. The information we provide includes the following:

the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing;
the right to lodge a complaint with a supervisory authority;
if the personal data are not collected from you, we provide you with available information about the source of the personal data;
the existence of automated decision-making, including profiling, referred to in Articles 22.1 and 22.4 GDPR and, in those cases, meaningful information about the logic involved, as well as the significance and the predicted consequences of such processing; and
where your personal data are transferred to a third country or to an international organization, you have the right to information regarding the appropriate safeguards, pursuant to Article 46 GDPR, put in place for the transfer.

For any further copies of the personal data undergoing processing requested by you, we may charge a reasonable fee based on administrative costs. If you have made the request by electronic means the information will be provided to you in a commonly used electronic form, unless otherwise requested by you.

Your right to obtain a copy referred to above shall not adversely affect the rights and freedoms of others.

Right to rectification (Article 16 GDPR)

You have a right to obtain, without undue delay, the rectification of inaccurate personal data concerning you that we may be processing.

In detail: Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

We will communicate any rectification of personal data to each recipient whom the personal data have been provided to, unless this proves impossible or involves disproportionate effort. If you want information about those recipients, you are more than welcome to contact us.

Right to erasure (“the right to be forgotten”) (Article 17 GDPR) and restriction of processing

You have the right to ask us to erase your personal data.

In detail: We have the obligation to erase your personal data without undue delay where one of the following grounds applies:

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
you withdraw your consent on which the processing is based, and there is no other legal ground for the processing;
you object to the processing pursuant to Article 21.1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21.2 GDPR;
the personal data have been unlawfully processed; or
the personal data have to be erased for compliance with a legal obligation in Union or Member State law that applies to us.

We will notify any erasure of personal data carried out in accordance with your rights stated above to each recipient whom the personal data have been provided to, unless this proves impossible or involves disproportionate effort. If you want information about those recipients, you are more than welcome to contact us.

Please note that our obligation to erase and inform according to above shall not apply to the extent processing is necessary according to the following reasons:

for exercising the right of freedom of expression and information;
for compliance with a legal obligation which requires processing by Union or Member State law which applies to us; or
for the establishment, exercise or defence of legal claims.

Right of restriction of processing (Article 18 GDPR)

You have the right to request that we restrict our processing of your personal data.

In detail: Your right applies if:

the accuracy of the personal data is contested by you, during a period enabling us to verify the accuracy of the personal data;
you have objected to processing pursuant to Article 21.1 GDPR pending the verification whether our legitimate grounds override yours;
the processing is unlawful, and you oppose the erasure of the personal data and instead request the restriction of their use; or
you need the personal data for the establishment, exercise or defence of legal claims even though we no longer need the personal data for the purposes of the processing.

Where the processing has been restricted according to above, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

We will notify each recipient whom the personal data have been provided to about any restriction of processing according to above, if this do not occur to be impossible or entails a disproportionate effort. If you want more information about these recipients, you are welcome to contact us.

Right to data portability (Article 20 GDPR)

You have the right to receive your personal data (that you have provided to us) from us in a structured, commonly used and machine-readable format and, where technically feasible, have your personal data transferred to another data controller (“data portability”).

In detail: The right applies if:

the processing is based on the lawful basis consent, and
the processing is carried out by automated means.

The exercise of the right to data portability shall be without prejudice to the right to erasure, i.e. Article 17.

Your right to data portability shall not adversely affect the rights and freedoms of others.

Balancing of interests assessments when processing personal data based on the legal basis “legitimate interests”

As we state above, for some purposes, we process your personal data based on our “legitimate interest”. By carrying out a balancing of interests assessment concerning our processing of your personal data, we have concluded that our legitimate interest for the processing outweighs your interests or rights which require the protection of your personal data.

If you want more information in relation to our balancing of interests assessments, please do not hesitate to contact us. Our contact information can be found at the beginning of this privacy policy.

This privacy policy was latest updated by Upsales Nordic AB on 19 dec 2025.