Privacy Policy - Information regarding processing of your personal data

Barry Callebaut Sweden AB, Reg. No. 556660-9136, Böketoftavägen 23, 268 77 Kågeröd, Sweden (“BC Sweden”, “we”, “our” or “us”) is specialised in the vending beverage business.

BC Sweden is the data controller regarding the processing of personal data that is conducted within our business, which is described in more detail in this policy. Should you have any questions regarding our processing of your personal data, please contact us at [email protected] or via the contact details in section 6. 

What kind of processing (which is a generic term in the EU Data Protection Regulation (“GDPR”) for operations which is performed on your personal data) that we carry out regarding your personal data, depends on the context in which you come into contact with us and in which capacity you act. To make it easier for you, we have divided this policy into different category sections based on which services you use with us, for example customer service or purchase of our products, where under each category you can read about what kinds of processing are carried out. 

After the category sections, follows multiple sections that are common to all types of services. These sections contain information about e.g., who we share your personal data with, where we process your personal data, what rights you have vis-à-vis us and how you get in touch with us. Below, you can click yourself to each section.

1. Which personal data are used for what, on which legal basis and for how long?
2. With whom do we share your personal data?
3. You have the right to object to the sharing of your personal data, due to circumstances in your individual case. More information about your right to object can be found below in section 4.5.
4. Where do we process your personal data?
5. What rights you have vis-à-vis us 
6. Changes to, and updates of, the Privacy Policy
7. How you get in touch with us

It is important to us that you feel safe with what types of personal data we collect and, even more importantly, how we process them. Thus, this policy covers the necessary information about this, which is why we think it is important that you read and understand the information. 

1. Which personal data are used for what, on which legal basis and for how long? 
   1.  Request for quotation

2. Purchase of our products

3. Supply of material and products for our business

4. Job application

5. How have we performed the assessment of the balance of interests when the legal basis for processing your personal data is our legitimate interest?

For certain purposes, we process your personal data and rely on our legitimate interest as the legal basis for the processing. In assessing the legal basis, we rely on a balancing of interests test by which we have determined that our legitimate interests of the processing override your interest and your fundamental right not to have your personal data processed. We have stated our legitimate interest in the tables above. Please contact us if you want to read more about how this test has been performed. Our contact details can be found in section 6.

2. With whom do we share your personal data? 

If we process your personal data pursuant to section 1, some or all of such personal data may be shared with certain specific recipients. When we share your personal data, we ensure that the recipient processes them in accordance with this privacy notice, by, e.g. entering into Data Transfer Agreements or Personal Data Processing Agreements with the recipients. The agreements ensure that your data are processed in accordance with the GDPR and this privacy policy. We would like to emphasize that we do not sell your personal data to any third party.

1. Categories of recipients with whom we may share your personal data
   1. Group companies

Recipients: Companies within the Barry Callebaut group, within the EU/EEA.

Purpose and legal basis: This may be required for us to provide our services to you. We have a legitimate interest of being able to provide these services. If the sharing of your personal data is necessary to fulfil that interest, and that interest overrides your right not to have your data processed, the sharing may be carried out on the legal basis of legitimate interest.

2. Suppliers and subcontractors

Recipients: We have agreements with other companies that perform certain services on our behalf. These services include, e.g. deliveries and distribution of goods. These companies gain access to your personal data to the extent necessary for them to fulfill their assignment, but they may not use or share the data for other purposes. Our suppliers and subcontractors process your personal data within the EU/EEA.

Purpose and legal basis: We sometimes need to access the services of other companies. In such cases, we have a legitimate interest of being able to access these. If the sharing of your personal data is necessary to fulfill that interest, and that interest overrides your right not to have your data processed, sharing may take place on the legal basis of legitimate interest. However, these companies may not process or use your personal for any other purposes than to perform the services pursuant to the agreement. 

3. Authorities

Recipients: The Swedish Police Authority, the Swedish Enforcement Authority or other authorities or courts of law. 

Purpose and legal basis: By law, we are obliged to share personal data with certain authorities, for example under the Act on Measures against Money Laundering and Terrorism Financing (Sw. lagen om åtgärder mot penningtvätt och finansiering av terrorism). Sharing may also occur in some cases when you have requested us to do so. Thus, sharing to authorities can be carried out on the legal basis of compliance with legal obligations or consent.

4. Third party in corporate transaction

Recipients: If we, or a significant part of our business, were to be sold to or integrated with a third party, your personal data may be passed on to the new owner of the business. Thereafter, the new owner of the business will be the data controller of your personal data. 

Purpose and legal basis: We may have a legitimate interest in selling our business to third parties or integrating our business with the business of third parties. Your personal data may therefore be shared with such third parties on the basis of our legitimate interest.

2. Objections to the sharing of your personal data

You have the right to object to the sharing of your personal data, due to circumstances in your individual case. More information about your right to object can be found below in section 4.5.

3. Where do we process your personal data?

All processing of your personal data is carried out within EU/EEA and no personal data are transferred to third countries.

4. What rights you have vis-à-vis us 

According to applicable legislation, you have the right to exercise certain rights against us, when we process your personal data. Below we describe each right, and what it means for you in relation to the personal data we process. If you want to read more about what the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten) writes about these rights, there are links under each section to the relevant page on the Swedish Authority for Privacy Protection’s website.   

If you want to exercise any of these rights, want to know more, or have questions, please feel free to contact us at [email protected] or by using the contact details set out in section 6 below. 

1. Right to information 

You have the right to be informed about how we process your personal data. In this privacy policy, we generally describe what personal data are processed by us in different contexts. If you want to know more about whether we process your personal data, and to what extent it is done, you can contact us as described above and request information about what personal data we process. 

If you want to read more about the right to information – please see here.

2. Right to access your personal data (register extract)

We can also provide you with a copy, a so-called register extract, of the personal data processed by us. In the register extract, we provide information about e.g. which categories of personal data are processed, what the personal data are used for, for how long the data will be stored, with whom the personal data has been shared and where the data come from. 

If you want to read more about the right to access – please see here.

3. Right to rectification

We strive to always have accurate personal data about you and to update them when necessary. If you discover that we process inaccurate data about you, you have the right to contact us as described above to have these corrected. You also have the right to ask us to complete incomplete data if this is relevant based on the purposes for which your data are processed, by providing us with additional information. 

If you want to read more about the right to rectification – please see here. 

4. Right to erasure (right to be forgotten) 

You have the right to request the erasure of your personal data. However, this right is not absolute. Certain conditions must be at hand in order for us to erase your data. For example, you may have the right to have data erased if they are no longer necessary for the purposes for which they were collected, if you withdraw your consent or if you object to us using your data for direct marketing. 

The right to erasure is also limited in the event that an exception applies to the data in question. For example, we have the right to retain the data if it is necessary for establishing, exercising or defending legal claims.

If you want to read more about the right to erasure – please see here. 

5. Right to object

You always have the right to object to our processing if the legal basis for the processing (this is stated in the various processing operations above in section 1) is that it is necessary for purposes relating to our legitimate intertest.

If you object, we do not have the right to process the data anymore, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or if it is needed for the establishment, exercise or defense of legal claims. If we consider that we have such legitimate grounds, or if the data are needed for the establishment, exercise or defense of legal claims, we will notify you of this, and the reasons for such assessment.

You can also object to your personal data being processed for marketing purposes (including profiling if this is included as part of this). If you do so, we will cease the processing for these purposes. 

If you want to read more about the right to object – please see here. 

6. Right to restriction

You can request that the processing of your personal data should be restricted, for example if you do not think that the information we have about you is correct or if you believe that the processing is unlawful. Such request can also be made during the time we investigate whether our legitimate interests override your interest of privacy when you object to the processing (see more about this under section 4.5 above).

 If you want to read more about the right to restriction – please see here. 

7. Right to transmit personal data (data portability) 

You have the right to receive your personal data, that you have provided to us (in case the legal basis for our processing is consent or performance of a contract), in a structured, commonly used and machine-readable format. However, this presupposes that the processing takes place by automated means (i.e. not in physical form on paper). If technically possible, and you wish to do so, we may also transmit such personal data to another data controller.

If you want to read more about the right to transmit personal data (data portability) – please see here.

8.  Right to withdraw your consent 

You can withdraw the whole or part of the consent you have given at any time, with effect as from the withdrawal (i.e. the processing of personal data that we have carried out before the withdrawal will not be affected). This can be done by contacting us via the contact details in section 6. In the case of direct marketing via e-mail, a withdrawal can be carried out through a link attached in each such e-mail.

9. Right to lodge a complaint with the competent supervisory authority 

You can lodge a complaint to the Swedish Authority for Privacy Protection (or with another supervisory authority) if you believe that our processing of your personal data is not in accordance with applicable legislation.

If you want to read more about the right to lodge a complaint – please see here.

10. Requirements for exercising your rights

To protect your privacy, we may (if necessary) require you to prove your identity when you contact us to exercise your rights.

We handle your request to exercise your rights promptly. Your request will normally be answered within one month from the date the request was received by us. Only in the case of an unusually complicated request, or if we have received a large number of requests, the response time may be extended by up to two months. If an extension of the response time is decided upon, you will be notified of that.

5. Changes to, and updates of, the Privacy Policy

We may make changes to the privacy policy if this is necessary to describe how we process your personal data. All such changes are posted here on the website, which is why you should review the privacy policy at regular intervals and each time you use our services. 

6. How you get in touch with us

If you have any questions or comments regarding the processing of your personal data, you can contact us via the e-mail address below. 
 

Barry Callebaut Sweden AB, Reg. No. 556660-9136 

Address: Böketoftavägen 23, 268 77 Kågeröd, Sweden

E-mail: [email protected]

Phone number: +46(0)418-450350

Cookie Policy

Barry Callebaut Sweden AB, Reg. No. 556660-9136, Böketoftavägen 23, 268 77 Kågeröd, Sweden (“BC Sweden”, “we”, “our” or “us”) uses cookies in accordance with the present policy. 

Cookies and Similar Technologies

• When accessing the Website, we may use cookies and other tracking technologies to identify users. A "cookie" is a small text file installed on your device or on your browser that is used to improve the quality of our offerings and to better understand how users interact with the Website. Most browsers are initially set up to accept cookies. You can reset your browser to refuse all cookies or to indicate when a cookie is being sent. However, some features or services (such as layout renderings or language preferences) on the Website may not function properly without cookies.
• If you have provided us with personally identifiable information, we may associate your personally identifiable information with information gathered through these tracking technologies. This allows us to offer increased personalization and functionality to users.
• Do-Not-Track Signals and Similar Mechanisms: Some web browsers may transmit "do-not-track" signals to websites with which the browser communicates. Our Website does not currently respond to these “do-not-track” signals.
• For further information on the type of cookies that may be used through the Website and possibilities to manage the cookie settings, you can consult the Cookie Settings  page of the Website. A permanent link to this Cookie Settings page can be found in the footer of the Website.