Privacy notice - for contact persons of Kivra’s partners

Here we have gathered information about Kivra's processing of personal data for contact persons of Kivra's partners. This information applies as of 2022-10-06.

General information about personal data

To make it easy for you to find the sections you are interested in, we have divided the page into a number of headings. You can click on the different headings in the list on the right to go directly to a specific section.

What is personal data?

Personal data is any information that can be directly or indirectly linked to a living, natural person. Examples of personal data are name, e-mail address, telephone number.

What is special about personal data?

All personal data is linked to a specific person. Most of us want to be able to control who we share our personal data with, and how it is used. For this reason, there are specific laws and rules regarding how companies and other actors may process personal data, known as data protection legislation. Examples of such laws and regulations are the General Data Protection Regulation (2016/679,GDPR) and the Act containing supplementary provisions to the EU General Data Protection Regulation (SFS 2018:218).

Data protection legislation governs how companies and other actors may process personal data, and what rights individuals have when their personal data is processed.

What is the processing of personal data?

Processing of personal data is basically anything that is done with personal data - for example, collecting, storing, analyzing or erasing personal data.

What does it mean to be a data controller?

A controller is the actor, such as a company or a public authority, that determines the purpose(s) for which personal data is processed and how the processing is carried out. The controller is responsible for ensuring that the processing of your personal data is carried out in accordance with data protection legislation.

What does it mean to be a data processor?

In certain situations, the controller may use a so-called processor, who is entrusted with the processing of personal data on behalf of the controller.A processor may only process personal data in accordance with the instructions of the controller, and may not use the data for its own purposes.

Kivra is the controller

The controller for the processing of your personal data that takes place in connection with a collaboration, partnership or business relationship with Kivra is:

Kivra Sverige AB, org. no. 556917-3544, (referred to in this information as "Kivra", "we" or "us")

Klara Norra kyrkogata 33, 111 22 Stockholm, Sweden

Email: dataskydd@kivra.se

What personal data does Kivra process, why and on what legal basis?

When Kivra processes personal data about you, the processing is always for the purpose of establishing or maintaining a business relationship between the company you represent and Kivra.

In the table below you can find more detailed descriptions of the processing Kivra carries out:

What personal data about you Kivra processes.
The source of the personal data, i.e. whether we received the data from you or from another source.
For what purpose(s) we use your personal data.
The so-called legal basis for processing your personal data for a particular purpose. A legal basis is a reason for using the data that is justified under data protection legislation.

Personal data	Source	Purpose	Legal basis
Name, professional title, e-mail address, mobile phone number, direct number/connection Other information you provide to Kivra in email correspondence	You personally or through the company/organization you represent within the framework of an agreement concluded between Kivra and the company/organization, or as part of a dialogue prior to any such an agreement. Kivra may also check the contact details of the company/organization against the register of the Swedish Companies Registration Office in order to keep the contact details that we hold about you up to date and accurate.	Communicate with you in accordance with the agreement or in dialogue prior to any such agreement. The e-mail address is also used to send you information such as press releases, newsletters, invitations to events, etc. (These newsletters can be opted out of by notifying Kivra, or by unsubscribing through the link in the mailing).	Balancing of interests (justified by the fact that Kivra has a strong legitimate interest in being able to communicate with you in accordance with the agreement or with the organization you represent or for dialogue prior to the conclusion of such an agreemen,t and to keep you informed about Kivra's services, invite you to events, maintain a good business relationship with you and the organization you represent).
Name, professional title, e-mail address, mobile phone number, direct number/connection Other information about you that you provide to Kivra in email correspondence.	You personally, such as when you send us an e-mail, make contact by telephone or if you meet a Kivra representative and provide him/her your contact information (e.g. your business card).	Communicate with you to establish or maintain a business relationship with you or the organization you represent. The e-mail address is also used to send you information such as press releases, newsletters, invitations to events, etc. (These newsletters can be opted out of by notifying Kivra, or by unsubscribing through the link in the mailing).	Balancing of interests (justified by Kivra having a strong legitimate interest in communicating with you, establishing or maintaining a business relationship with you, keeping you informed about Kivra's services and inviting you to events).
Name, professional title, e-mail address, mobile phone number direct number/connection	From external sources such as through Kivra's own searches for "contact person or function at company X”	Contact you to establish a business relationship. The e-mail address is also used to send you information such as press releases, newsletters, invitations to events, etc. (These newsletters can be opted out of by notifying Kivra, or by unsubscribing through the link in the mailing).	Balancing of interests (justified by Kivra having a strong legitimate interest in establishing or maintaining a business relationship with you or the organization you represent, keeping you informed about Kivra's services and inviting you to events).
Company name, email address, phone number, name and other information needed to handle your matters with Kivra Sender Support.	The Sender personally or from the partner through which the Sender has chosen to integrate with Kivra.	Company name, email address, telephone number and name are processed for the purpose of enabling Kivra to provide you with support to perform the agreement with you, report any incidents and otherwise provide you with support in using Kivra's services.	Balancing of interests (justified by Kivra having a strong legitimate interest in being able to provide Sender support). Kivra's legal obligation under the GDPR (where the support relates to the performance of Kivra's obligations under the GDPR).
Company name and registration number (in case the Sender is a sole trader)	The Sender personally or from the partner through which the Sender has chosen to integrate with Kivra.	Kivra processes company names and registration numbers in order to perform the agreement with the Sender, to inform Users that the Sender sends letters in Kivra, to carry out billing, to provide support, to keep updated records of Kivra's Senders, to produce reports on behalf of the Sender and to be able to produce statistics regarding the use of Kivra's services.	Your agreement with Kivra for the purposes of contract performance and billing. Balancing of interests for the other purposes mentioned (justified by the fact that Kivra has a strong legitimate interest in keeping up-to-date records in order to efficiently maintain and administer contractual relationships and to provide senders with relevant and up-to-date information and to enable Kivra to best tailor its services to the Senders represented in the service).
Name and e-mail address	Sender	The name and email address are processed for secure identification of the Sender's representative when the sender uses Kivra's Kivra Campaign service.	Balancing of interests (justified by Kivra having a strong legitimate interest in being able to identify the Sender when using Kivra's Kivra Campaign service).

For how long do we process your personal data?

Kivra has clear internal retention policies that ensure that personal data is not retained longer than is necessary to fulfill the purposes of the processing of personal data, as described in the table above.

Agreement

Personal data processed on the legal basis of an agreement will be processed by Kivra for as long as such an agreement is in force and thereafter for a maximum of one (1) year after the contractual relationship has ended (or earlier if you have been replaced by another contact person/representative or have otherwise notified us that you no longer wish us to process your personal data)

When the agreement ends, or when we otherwise decide that your personal data will no longer be stored for the purposes above, it will be erased (or anonymized), except for such data that we are required by law to keep for a longer period of time (e.g. under the Accounting Act). Thus, after your personal data has been erased as described above, your name and contact details may continue to appear in archived agreements and related documentation.

Legitimate interest

With respect to personal data that is retained on a balancing of interests as the legal basis, Kivra has determined that a maximum retention period of one (1) year is reasonable for the purposes based on a legitimate interest as described in the table above. However, we will erase (or anonymize) your personal data at an earlier stage if you inform us that you have been replaced by another contact person/representative for the organization you represent or otherwise notify us that you no longer want us to process your personal data.

Where is your personal data processed?

As a general rule, Kivra's processing of your personal data takes place only in Sweden. However, there may be certain situations where your personal data is processed in another country within the EU/EEA and, in exceptional cases, also in a country outside the EU/EEA. Where Kivra at any time needs to use a supplier established in a country outside the EU/EEA, Kivra will take all appropriate legal, technical and organizational measures to ensure that your personal data is processed securely and with an adequate level of protection comparable to and at the same level as the protection offered within the EU/EEA.

Who has access to your personal data?

Kivra's suppliers and subcontractors

We share information about you with our suppliers who provide services and functionality to Kivra, such as software, data storage and business consultants. The suppliers may in their turn disclose such information to their subcontractors. The suppliers and their subcontractors are Kivra’s processors.

We share your data with Kivra's suppliers because we need to access services and functionality from other companies that we are not able to provide ourselves. We share your data with our suppliers when we consider that we have a legitimate interest in accessing a supplier's service. We ensure that the processing it involves is necessary to pursue that interest, and that our interest outweighs your right not to have your data processed for this purpose.

Authorities

If a public authority requests information about you, and Kivra is required by law to provide the information, we will do so. Kivra also shares information about you with public authorities when we believe we have a legitimate interest in doing so, such as for Kivra to establish, enforce or defend its legal claims. We ensure that the processing it involves is necessary to pursue that interest, and that our interest outweighs your right not to have your data processed for this purpose.

State Personal Address Register (SPAR)

Kivra may check your personal data against the State Personal Address Register (SPAR) in order to keep the personal data we store about you up to date and accurate.

What rights do you have?

Under the different subheadings below, you can read about the rights you have when Kivra processes your personal data.

Right to information

Whenever Kivra collects personal data about you, you have the right to specific information about how we will process your personal data. You also have the right to get specific information if we plan to process your personal data for any purpose other than that for which it was originally collected.

We provide you with the information you are entitled to, and other information we believe is important to you, through this privacy notice. We will also provide you with information about how we process your personal data by answering any questions you may have for us.

You can read more about what information you are entitled to receive from us, what the requirements are for how the information is provided, etc. at The Swedish Authority for Privacy Protection’s website.

Right of access to your personal data

You have the right to obtain confirmation as to whether Kivra is processing personal data about you, and if so, to have access to the personal data we are processing, together with certain information about the processing.

You access your personal data by receiving a copy of the personal data we process, a so-called register extract.

It is free of charge for you to obtain a copy of your register extract. For any additional copies you request, Kivra may charge a reasonable fee to cover our administrative costs.

As a general rule, if you are a Kivra user, we will provide your register extract in the Kivra service. It can also be sent encrypted by e-mail, or to your registered address, if you prefer.

You can read more about what information you are entitled to receive from us in connection with your request for a register extract , the requirements for how the information should be provided, etc. at The Swedish Authority for Privacy Protection’s website.

Right to rectification

You have the right to request that we correct inaccurate information about you, and that we complete incomplete information about you.

You can read more about the right of rectification, examples of when it applies and how you can exercise it at the Swedish Authority for Privacy Protection’s website.

Right to erasure

In certain circumstances, you have the right to have the personal data Kivra processes about you erased. This is the case, for example, if it is no longer necessary for Kivra to process the data for the purpose for which the data was collected, if you withdraw your consent, or if you have objected to the processing and there are no legitimate, overriding reasons for the processing.

Your right to have your personal data erased is not absolute, but applies when the conditions for erasure are met. Examples of situations where those conditions are not met, and where we do not comply with your request, are if the data is still necessary to process for the lawful purpose for which it was collected, or if there is a legal requirement for us to retain the data.

You can read more about the circumstances in which you have the right to have your personal data erased, in which cases Kivra has the right to refuse your request for erasure, etc. at The Swedish Authority for Privacy Protection’swebsite.

Right to object to processing

You have the right, for reasons relating to your specific situation, to object at any time to the processing of your personal data by Kivra on the basis of a balancing of interests.

If you object to such processing, Kivra may no longer carry out the processing of your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms; or for the establishment, exercise or defense of legal claims.

You can read more about your right to object to personal data processing at the Swedish Authority for Privacy Protection’s website.

Right to restriction of processing

You have the right to request that we restrict our processing of your personal data if you believe that data we hold about you is inaccurate; that our processing is unlawful (but you object to erasure of the data); that we no longer need the data for the purpose for which it was processed (but you need it to establish, exercise or defend a legal claim); or if you have exercised your right to object to our processing of your personal data.

Where processing of your personal data has been restricted, Kivra will, with the exception of storage, only process the data with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person, or for reasons of substantial public interest.

You can read more about the right to restriction of processing and find examples of when it can be invoked at the Swedish Authority for Privacy Protection’s website.

Right to transfer your personal data to another recipient ("Right to data portability")

You have the right to receive certain personal data about you in a structured, commonly used and machine-readable format, known as data portability. You have the right to transfer such data to another recipient. If technically feasible, as determined by Kivra, you also have the right to request that Kivra transfer the data to the other recipient.

The right to data portability covers personal data relating to you, which you have provided to Kivra, which Kivra processes automatically, and which you have consented to provide to Kivra or which you have provided to Kivra pursuant to a contract.

You can read more about the right to data portability at the Swedish Authority for Privacy Protection’s website.

Right to withdraw consent

Where we process your personal data based on your consent, you have the right to withdraw your consent at any time. When you withdraw your consent, we will stop the processing. The withdrawal of your consent does not affect the lawfulness of the processing that was based on your consent before it was withdrawn.

Right to lodge a complaint

If you have a complaint about Kivra's processing of personal data, you can contact the Swedish Authority for Privacy Protection, which is the supervisory authority for Kivra's personal data processing. For more information on how to lodge a complaint with the Swedish Authority for Privacy Protection, please visit the authority's website.

How can you exercise your rights?

You can read more about your rights, how to exercise them and how to file a complaint on the Swedish Authority for Privacy Protection's website.

If you wish to get in touch with Kivra to exercise your rights under the GDPR, you can reach us by email dataskydd@kivra.se or telephone: 077-045 70 00.

If you wish to exercise any of your rights, we will inform you of the actions we have taken in response to your request within one month at the latest. This period may be extended by a further two months if necessary in view of the complexity of the request or the number of requests received. We will inform you of such an extension and the reasons for the extension within one month of receiving your request.

Exercising your rights is free of charge for you, unless your requests are manifestly unfounded or unreasonable. In the latter case, we may charge a reasonable fee to cover our administrative costs in complying with your request, or refuse your request.

If we do not take action on your request, we will, within one month of receiving it, inform you of the reason for the failure to take action and of the possibility of lodging a complaint with the Swedish Authority for Privacy Protection and requesting a judicial remedy.

Where do you turn if you have questions?

All Kivra employees receive data protection training and information, and we have a dedicated team to answer your data protection questions, receive feedback and allow you to exercise your rights. Kivra also has a Data Protection Officer (DPO) who monitors our compliance with the GDPR.

You are always welcome to contact Kivra by e-mail dataskydd@kivra.se or by phone: 077-045 70 00 if you have any questions or feedback about how we handle your personal data.

Kivra's data protection team and DPO can be reached by email at: dataskydd@kivra.se. If you wish to contact the DPO directly, please enter "DPO" in the subject line.