Privacy Policy

1. General

1.1 Boule Diagnostics AB (publ) and its group companies (“Boule”) is committed to protecting your personal privacy, and this Privacy Notice (“Privacy Notice”) explains how we collect and use your personal data.
1.2 Our mission is to help you feel confident that your privacy is respected and that your personal information is processed correctly. We take responsibility for ensuring that the personal data processed by Boule is used only for the intended purpose and is protected against unauthorized access. All processing of personal data at Boule is carried out in accordance with applicable personal data legislation. As of 25 May 2018, the General Data Protection Regulation (GDPR) is in force within the EU/EEA.

2. Data controller and scope

2.1 Boule Diagnostics AB (publ), org.no. 556535-0252, is the data controller for the processing of your personal data and is thus responsible for ensuring that the processing of personal data complies with applicable legislation. You can find our contact details in the end of this Privacy Notice.
2.2 This Privacy Notice is applicable to all processing of personal data in relation to our (i) suppliers, consultants, and customers, (ii) website visitors, (iii) job-applicants and (iv) investors, when we act as data controller. In section 5 and 9 we describe how we process personal data, and which personal data we may transfer, in relation to each group of registrants.

3. What is personal data and what is the processing of personal data?

3.1 Personal data is any information that directly or indirectly, together with other information, can be connected to a natural person. For example, your name, email address, address and IP addresses constitute personal data.
3.2 The processing of personal data is anything that happens to personal data. Any action carried out with personal data is defined as processing, irrespective of whether it is automated or not, such as collection, recording, organization, structuring, storage, editing or modifying, retrieval, reading, use, transfer or making available by other means, adjustment or collation, limitation, erasure or destruction.

4. From where do we collect your personal data?

4.1 We collect the information you provide to us. You may give us information about yourself directly or indirectly in a number of ways, such as when you send us an email when signing agreements and when you apply for work at Boule.
4.2 If you apply for a job at Boule, we may collect information about you from your reference persons that you provide to us or from authorities or through retrieval of information which is publicly accessible through online searches. We do not collect any information from other sources.

5. Our processing of personal data

5.1 Boule always processes your personal data in accordance with applicable legislation. We process your personal data when it is necessary to fulfill an agreement with you or when we have another legitimate and justified interest in processing your personal data. When we apply the legal basis legitimate interest, it means that the processing is necessary to satisfy our legitimate interest, for example, in order to be able to offer you training and product information. If Boule should process your personal data for any purpose that, according to applicable legislation, requires your consent, we will obtain your consent in advance, by allowing you to actively check a box or sign a form.
5.2 More information about our processing of personal data is provided in the tables below, divided into groups of registrants, including information about why we process your personal data, what personal data we process to achieve those purposes and for how long we retain your personal data for each specified purpose.

5. Suppliers, consultants and customers (contact persons)

Administration and performance of contracts

  • What we do: We use your personal data to provide, administer and develop our products and services, and to provide customer service to you as our customer, e.g., in the event of complaints and quality matters.
  • Categories of personal data:
    Contact details such as name, title/role of the supplier or customer, telephone number and e-mail address. Login details when applicable such as e-mail address and password.
  • Legal basis: Performance of a contract.
  • Retention period: The personal data is retained for the duration of the contractual relationship and for up to 12 months after the termination of the contract. If contact details are available in relation to invoice documentation, we will retain your personal data for seven years after terminated financial year in accordance with

Collection of information for warranty matters and complaints

  • What we do: We process your personal data as a contact person within our customer’s organisation to handle any complaints and warranty matters when, in addition to fulfilling our agreement with you, we have a legal obligation to tend to a warranty matter.
  • Categories of personal data:
    Contact details such as name, title/role within the supplier or customer, telephone number and e-mail address.
    Login details when applicable such as e-mail address and password.
  • Legal basis:
    Legal obligation.
  • Retention period:
    The personal data is retained for the duration of the warranty matter or complaint and for up to 12 months after the matter was terminated or any longer period of time required pursuant to applicable legislation.

Marketing, including individually targeted direct marketing, and invitations to marketing events and trainings

  • What we do:
    We process your personal data for marketing purposes. Our marketing activities may include newsletters, or other mailings of information about new products or special offers. Targeted marketing may entail, for example, that we analyse your use of our services and products such as when you usually make purchases and tailor our marketing measures based on such individual insights.
    When you previously have been a customer with us, we may send out e-mails with marketing messages to you without asking for your consent, but you are always given the opportunity to unsubscribe from such mailing, so-called “opt-out”.
  • Categories of personal data:
    Contact details such as name, telephone number and e-mail address.
    Browsing habits and visit history such as the pages you have visited on our (and other) websites and the duration of your visit.
  • Legal basis:
    Legitimate interest as we assess that our interest in sending you maketing and information outweighs your interests or fundamental rights and freedoms demanding protection of personal data.
  • Retention period:
    The personal data is stored and used throughout the contractual relationship and up to 12 months after the contractual relationship ends.
    If you request to unsubscribe, we will immediately cease processing your personal data.

Business development

  • What we do:
    We use your personal data, such as data derived from statistical compilations, market segmentations and customer satisfaction surveys for the purposes of conducting market and customer analyses. The results of our analyses are used for improving, replacing and developing new products and services, processes or working methods with the goal of developing our business and constantly improving in meeting our customers expectations and needs. For example, we may process your personal data to improve our customer service, to offer new solutions or to adapt our website and/or app in accordance with our customers’ preferences. We always pseudonymise, and if possible anonymise, the personal data we process to the greatest extent possible for achieving the purpose of the processing.
  • Categories of personal data:
    Contact details such as name, telephone number and e-mail address.
    Browsing habits and visit history such as the pages you have visited on our (and other) websites and the duration of your visit.
  • Legal basis:
    Legitimate interest as we assess that our interest in developing our business to better meet our customers expectations and needs outweighs your interests or fundamental rights and freedoms requiring protection or personal data.
  • Retention period:
    The personal data is stored and used throughout the contractual relationship and up to 12 months after the contractual relationship ends.

Defending our legal interests

  • What we do:
    In the event of a dispute, such as a payment dispute, we have the right to use your data for the purpose of establishing, defending or enforcing the legal claim.
  • Categories of personal data:
    Contact details such as name, social security number, telephone number and e-mail address.
    Login details where applicable, such as e-mail address and password.
  • Legal basis:
    Legitimate interest as we assess that our interest in defending our interests in the event of a dispute outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
  • Retention period:
    Your personal data is retained for as long as necessary for us to exercise or defend a reasonable expected legal claim in case of a dispute within the foreseeable future.

Administration in connection with mergers and acquisitions, restrucuring, etc.

  • What we do:
    If Boule is to be restructured, e.g. divided into several different businesses, or if a third party acquires Boule or our customer database, Boule will disclose your personal data and that of other customers to the acquiring company. That company will continue to use your personal information for the same purposes as those stated in this Privacy Notice, unless you are informed otherwise in connection with the transaction. The acquiring company will then, as the new data controller, inform you of its processing of your personal data.
  • Categories of personal data:
    Contact information such as name, telephone number and e-mail address.
    User data such as behavior patterns and browsing habits, such as pages you have visited on our website and the duration of your visit.
    Device data such as IP number.
    Location data such as information about your location when you visit our website.
    Other information that you choose to share.
  • Legal basis:
    Legitimate interest as we assess that our interest in enabling an acquisition or restructuring process, assuming that the acquiring company carries out similar operations as Boule, outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
  • Retention period:
    If Boule ceases to exist, e.g. through a merger, liquidation or bankruptcy, or if Boule´s customer database is transferred to an acquiring company, we will erase the personal data as long as the retention of such personal data is not required by law. In such case your personal data will be processed in accordance with this Privacy Notice.

5. Website visitors

Provision, administration and management of Boule’s website

  • What we do:
    We process your personal data to provide, administer and manage our website for the benefit of you and other website visitors. We do this primarily by retrieving information from cookies.
    In order for us to be able to offer you a good service when you visit our website, we may also process information about you if you, for example, choose to contact us or to subscribe to our newsletters.
  • Categories of personal data:
    Contact information such as name, telephone number and e-mail address.
    User data such as behavior patterns and browsing habits, such as pages you have visited on our website and the duration of your visit.
    Device data such as IP number.
    Other information that you choose to share.
  • Legal basis:
    Legitimate interest as we assess that our interest of providing, administering and manage our website outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
  • Retention period:
    The personal data is stored for as long as it is necessary for us to be able to provide, administer and manage our website. If you contact us with, for example, a question about our services, we process your personal data while your case is being processed and up to 2 months thereafter.

 

 

Business development

  • What we do:
    We process your personal data to analyze, improve and develop our website.
    For this purpose, we also use third-party tools to collect aggregated data about visitors to our website.
  • Categories of personal data:
    User data such as behavior patterns and browsing habits, such as pages you have visited on our website and the duration of your visit.
    Location data such as information about your location when you visit our website.
    Device data such as IP number.
  • Legal basis:
    When using other than necessary cookies, we always obtain your consent, please see our cookie policy for more information.
  • Retention period:
    Please see our cookie policy.

Administration in connection with mergers and acquisitions, restructuring, etc.

  • What we do:
    If Boule is to be restructured, e.g. divided into several different businesses, or if a third party acquires Boule or our customer database, Boule will disclose your personal data and that of other customers to the acquiring company. That company will continue to use your personal information for the same purposes as those stated in this Privacy Notice, unless you are informed otherwise in connection with the disclosure. The acquiring company will then, as the new data controller, inform you of its processing of your personal data.
  • Categories of personal data:
    Contact information such as name, telephone number and e-mail address.
    User data such as behavior patterns and browsing habits, such as pages you have visited on our website and the duration of your visit.
    Device data such as IP number.
    Location data such as information about your location when you visit our website.
    Other information that you choose to share.
  • Legal basis:
    Legitimate interest as we assess that our interest in enabling an acquisition or restructuring process, assuming that the acquiring company carries out similar operations as Boule, outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
  • Retention period:
    If Boule ceases to exist, e.g. through a merger, liquidation or bankruptcy, we will erase the personal data as long as the retention of such personal data is not required by law. In such case your personal data will be processed in accordance with this Privacy Notice.

5. Job-applicants

Administration of the recruitment process, evaluation of candidates through the collection of data and the holding of job interviews

  • What we do: We process job applicants’ personal data to manage recruitment processes. The recruitment process includes reviewing employment applications, interviewing relevant candidates and obtaining references for relevant candidates.
  • Categories of personal data:
    Contact information such as name, telephone number and e-mail address.
    Application documents such as CV, personal letter, grades, and certificates.
    Contact information for the people you have provided as references.
    Notes and similar records from job interviews.
  • Legal basis:
    Legitimate interest as we assess that our interest in administering employment applications for the purpose of hiring staff outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
  • Retention period:
    The personal data is saved until a recruitment process is completed and another 2 years thereafter.

Administration in connection with mergers and acquisitions, restructuring, etc.

  • What we do:
    If Boule is to be restructured, e.g. divided into several different businesses, or if a third party acquires Boule, Boule will disclose your personal data and that of other customers to the acquiring company. That company will continue to use your personal information for the same purposes as those stated in this Privacy Notice, unless you are informed otherwise in connection with the disclosure. The acquiring company will then, as the new data controller, inform you of its processing of your personal data.
  • Categories of personal data:
    Contact information such as name, telephone number and e-mail address.
    Application documents such as CV, personal letter, grades and certificates.
    Contact information for the people you have provided as references.
    Notes and similar records from job interviews.
  • Legal basis: Legitimate interest as we assess that our interest in enabling an acquisition or restructuring process, assuming that the acquiring company carries out similar operations as Boule, outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
  • Retention period: If Boule ceases to exist, e.g. through a merger, liquidation or bankruptcy, or if Boule´s customer database is transferred to an acquiring company, we will erase the personal data as long as the retention of such personal data is not required by law. In such case your personal data will be processed in accordance with this Privacy Notice.

5. Investors

Keeping of a share register and other regulatory obligations applicable to companies listed on a regulated market.

  • What we do:
    We process your personal data to keep a share register and fulfill other obligations we have as a company listed on a regulated market, such as to handle your personal data if you register and participate in a general meeting.
  • Categories of personal data:
    Contact information such as name, telephone number and e-mail address.
    Social security number or organization number (if sole proprietorship).
    Your number of held shares.
  • Legal basis:
    Legal obligation.
  • Retention period:
    We save your personal data for as long as it is necessary to fulfill the legal obligation. For example, personal data that is kept in our share register is retained for 10 years after you have been removed from the share register.

6. Automated decision-making

6.1 We do not use automated decision-making.

7. Retention of personal data

7.1 We will only retain your personal data for as long as it is needed for the purposes we collected the personal data as described in this Privacy Notice. When we no longer need your personal data, we will remove the personal data from our systems and databases, including any back-ups. More specific retention periods for each purpose are provided in the tables in section 5 above under the heading “Retention period”.

8. Security for the protection of personal data

8.1 Boule is committed to a high level of security for your personal data and is taking appropriate technical and organizational security measures to protect your personal data from unauthorized access, modification, dissemination or destruction. Should a data breach that materially impacts you or your personal data occur, e.g. entailing risk of fraud or identity theft, we will contact you to explain what has happened and to provide you with advice on how you can mitigate any potential adverse effects of such data breach relevant for you.

9. With whom do we share your personal data?

9.1 Boule may appoint external partners (suppliers) to carry out tasks on behalf of Boule, e.g. to provide IT services, payment solutions or help with marketing, analysis or statistics. The execution of these services may mean that Boule’s partners can access your personal data. Companies processing personal data on behalf of Boule always sign agreements with Boule to ensure a high level of personal data protection with our cooperation partners. Boule may disclose personal data to third parties, such as the police or other authorities, if it relates to the investigation of criminal offenses or otherwise if we are obliged to disclose such data by law or on the basis of official decisions. In the tables below, you will find information about which external parties we may disclose personal data to and which categories of personal data that will be disclosed in such case.

9. Supplier, consultants and customers

We may share your data with:

  • Suppliers of IT systems and administrative services such as payment services.
  • Purchaser or other successor in the event of mergers, divestitures, restructuring, reorganization, dissolution and other sales or transfers of Boule’s assets.
  • Authority or equivalent third party in connection with audits, court proceedings or for other similar reasons. This is to fulfill legal obligations and be able to safeguard our legal interests in the event of a dispute.

Categories of personal data that are shared:

  • Contact information to you as a supplier, consultant or customer, such as name, telephone number, postal address and e-mail address.
  • All categories listed in section 5 attributable to suppliers, consultants and customers.
  • All categories listed in section 5 attributable to suppliers, consultants and customers.

9. Website visitors

We may share your data with:

  • Providers of third-party cookies such as Google Analytics.
  • Purchaser or other successor in the event of mergers, divestitures, restructuring, reorganization, dissolution and other sales or transfers of Boule’s assets.

Categories of personal data that are shared:

  • User data such as behavior patterns and browsing habits, such as pages you have visited on our website and the duration of your visit.
    Location data such as information about your location when you visit our website.
    Device data such as IP number.
  • All categories listed in section 5 attributable to website visitors.

9. Job-applicants

We may share your data with:

  • Reference persons to whom you provided contact information in connection with the hiring process.

Categories of personal data that are shared:

  • Information that you have provided in your application documents such as CV, personal letter, grades and certificates or in an interview with us.
  • All categories listed in section 5 attributable to job-applicants.

9. Investors

We may share your data with:

  • Suppliers who administer our company documentation, including share registers kept by Euroclear.

Categories of personal data that are shared:

  • Contact information such as name, telephone number and e-mail address.
    Social security number or organization number (if sole proprietorship).
    Your number of shares held.

9.2 Boule will not sell your personal data to any other party or disclose your personal data to any other extent than that described in this Privacy Policy.

Processed?

10.1 We only store your personal data in the EU/EEA or in a country subject to the European Commission’s adequacy decision.
10.2 In the event that personal data is processed in any country outside the EU/EEA or in a country that is not subject to the EU Commission’s adequacy decision by any of Boule’s downstream suppliers, Boule ensures that your personal data is protected and that the transfer is carried out in accordance with applicable law.

External links

11.1 This Privacy Policy applies to information about you which Boule processes through our channels. Boule’s digital channels may sometimes contain links to external websites or services which we do not control. If you follow a link to an external website, you are prompted to accept the policies in respect of personal data processing and information about cookies for the relevant site.

Your rights

12.1 Your right to access, rectification, erasure and restriction

12.1 Your right to access, rectification, erasure and restriction
12.1.1 In accordance with applicable personal data legislation, you have the right, at any time, to request access to the personal data which is processed about you, to get erroneous personal data corrected, to get Boule to stop processing and delete your personal data, to restrict the processing of your personal data, to exercise your right to data portability and to object to the processing of personal data. In such cases, please contact Boule at the address given below.

12.1.2 We have an obligation to respond to your requests to exercise your rights within one month from receiving your request. If your request is complex or if we have received many requests, we have the right to extend this deadline by two more months. If we are unable to take the action you have requested within one month, we will inform you of the reason for the delay and of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy.
12.1.3 You will not be charged for any information, communication or measures that we implement. However, if your request is manifestly unfounded or excessive, we may charge an administrative fee for providing the information or taking the action requested or refuse to act on your request altogether.

12.2 Your right to access, rectification, erasure and restriction

12.2 Your right to access, rectification, erasure and restriction
12.2.1 You have the right to request:

a) Access to your personal data. This means that you have the right to request access to personal data that we hold about you. You also have the right to be provided, at no cost, with information about which personal data we are processing about you. We have the right to charge a reasonable administration fee if you request further copies. If you make a request by electronic means, e.g. via email, we will provide you with the information in commonly used electronic format.
b) Rectification of your personal data. At your request or on our own initiative, we will correct, anonymize, delete or complete data that we know to be inaccurate, incomplete or misleading. Also, you have the right to complete any incomplete personal data if something relevant is missing.
c) Erasure of your personal data: You have the right to request that we erase your personal data if there is no compelling reason for us to continue processing the data. Compelling reasons for use to continue processing may be:
i. Processing is necessary for the right of freedom of expression and information,
ii. Processing is necessary to comply with a legal obligation,
iii. Processing is necessary for reasons of public interests in the area of public health,
iv. Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or
v. Processing is necessary for the establishment, exercise or defense of legal claims.
Your personal data will be erased if none of the circumstances above are applicable and if:
vi. The personal data is no longer needed for the purpose for which we collected them,
vii. We process your personal data based on your consent and you withdraw your consent,
viii. You object to us processing your personal data which is based on a legitimate interest assessment, and we have no compelling interests that overrides your interests or rights and freedoms,
ix. We have processed the personal data unlawfully, or
x. We have a legal obligation to erase the personal data.
d) Right to restrict processing. This means that we temporarily restrict the processing of your data. You have the right to request restriction when:
i. You consider your data to be inaccurate and you have requested rectification as defined in b), while we establish the accuracy of the personal data,
ii. The processing is unlawful, and you do not want the data to be erased,
iii. As data controller, we no longer need to process the personal data for our processing purposes, but you need them to be able to establish, exercise or defend a legal claim, or
iv. You have objected to processing as defined in 12.3, while waiting for our assessment of whether our legitimate interests override yours.
12.2.2 We will take all reasonable measures possible to notify everyone who has received personal data as stated in section 9 above if we have rectified, erased or restricted access to your personal data after you have requested us to do so. At your request, we will provide you with more information about the recipients of your personal data.

12.3 Your right to object to processing

12.3 Your right to object to processing
12.3.1 You have the right to object to the processing of your personal data if our processing is based upon legitimate interest (see section 5 above). If you object to such processing, we will only continue to process your data if we have compelling reasons for doing so that override your interests or rights and freedoms or if the processing is necessary for the establishment, exercise or defense of legal claims.
12.3.2 If you do not wish that we use your personal data for direct marketing purposes, you always have the right to object to such processing by contacting us. We will cease to use your personal data for that purpose when we have received your objection.

12.4 Your right to withdraw consent

12.4 Your right to withdraw consent
12.4.1 For the processing of your personal data we do based on your consent as the legal basis (see section 5 above), you always have the right to withdraw your consent. In connection with you giving your consent, we will always inform you on how to withdraw it. Our contact details are found in the end of this Privacy Notice.

12.5 Your right to data portability

12.5 Your right to data portability
12.5.1 You have the right to data portability. This means the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to have this personal data directly transferred to another data controller, provided that it is technically possible. You only have the right to data portability when the processing of your personal data is automated, and we base our processing on your consent or on an agreement between you and Boule.

Cookies

13.1 We use cookies and similar technologies on our website in order to, inter alia, improve your experience with us and to simplify and adapt our website to your needs and preferences. If you would like to know more about our use of cookies, please refer to our Cookie Policy here.

Changes to this privacy notice

14.1 This Privacy Notice was updated in November 2022.
14.2 We have the right to change this Privacy Notice at any time. The latest version of the notice will always be available on our website, www.boule.com.
14.3 When we make changes that are material or relevant, you will be notified of the changes within a reasonable time prior to the changes taking effect.

How to contact us

15.1 Boule is the responsible party for the processing of your personal data. If you have any queries relating to how Boule processes your personal data, please contact Boule at:
Boule Diagnostics AB (publ)
Domnarvsgatan 4
163 53 Spånga
Sverige
Email: info@boule.com