Privacy policy

Ecris AB(hereafter ‘Bilia’ or ‘we’) cares about your personal privacy, and have formulated this Privacy Policy to inform you how we process the personal data we collect when you buy our products and/or services, or visit us in some other way, at our facilities or via our website. Naturally we process your personal data in accordance with applicable legislation and regulations relating to data protection, and we have adopted technical and organisational measures to protect your personal data against accidental or unpermitted destruction, loss or amendment, unauthorised disclosure or access, and other unpermitted forms of processing.

Who is responsible for your personal data?

Ecris AB, corporate identity number 556484-6334, with the address Bäckamarken 5, SE-555 92 Jönköping, Sweden and phone number +46 (0)10-497 59 00, is the data controller for the processing of your data in accordance with this policy.

Processed personal data, purposes and legal basis for processing

The personal data we process is data provided by you or data retrieved from a third party.

For the following purposes we process your personal data to fulfil our contract with you or to take measures requested by you before a contract is entered into:

· If you, as a customer or representative of a company, make a purchase with us, we process data about your name, contact details, customer number and card number for the purposes of managing our customer relationship, including credit checks where applicable and your payments. We also process this data to fulfil our obligations resulting from the contracts you have entered into with us, and to provide you with the information about the products and services you have requested from us.

· We process data about your name, contact details and customer number to manage any claims you may have with regard to changing your mind, making a complaint, return or demand, or using your warranty.

For the following purposes we process your personal data backed by a statement of interest:

· We process data about your name and your contact details so we can communicate with you as a customer or if you have requested a price quote from us, by sending direct marketing, invitations to events or newsletters via post, e-mail or text message. Our legitimate interest in processing your personal data is that we wish to communicate with you if you have previously made a purchase, for marketing purposes and to assess and improve our offering.

· We process data about your name and your contact details so we can communicate with you as a potential customer by sending direct marketing, invitations to events and newsletters via post, e-mail or text message. Our legitimate interest in processing your personal data is to be able to communicate with you as a potential customer for marketing purposes.

· If you visit one of our websites or use our local network (WiFi) we may automatically collect personal data such as your IP address or the name of the device you are using in our local network. We collect such personal data for the purpose of preventing unauthorised intrusion or usage of our IT resources, and to simplify troubleshooting.

· We may process moving images from CCTV cameras when you visit one of our facilities. We use CCTV cameras for the purpose of preventing or discovering criminal activity, and to monitor and ensure the function of our car parks.

· If you contact Bilia, for instance via our website, email, chat or phone, we process the personal data you submit for the purpose of dealing with your query. Processing is necessary in order for us to fulfil our legitimate interest in managing and administering our contact with you. If you call our customer services, we may record your call and use it for training and development of our personnel in order to increase customer satisfaction.

· If you are registered as a contact person or similar in a company, we process your name and contact information in connection with procurement / purchasing procedures, other contract negotiations, invoicing or the like in order to carry out selection, sign agreements and administer the agreement. The processing is necessary to satisfy our legitimate interest in communicating with you as a contact person in order to maintain and fulfill our commitments in the business relationship.

· In order to develop and improve our products, services, applications, technical systems and IT infrastructure and also carry out tests in liaison with this, we may use your personal data in certain cases. The legal basis is our legitimate interest in making updates to the technology which makes it possible to develop the systems that we use or for you to be able to visit our website, shop in our web shop or to be able to understand how you as a customer experience our products and thereby improving existing and developing new services.

· When you register for an event, we use your contact information and other relevant information to provide, administer and follow up the event, e.g. to calculate the number of participants. We process the information on the basis of a balance of interests and our legitimate interest in providing events to inform about and market our products and services.

For the following purposes we process your personal data if you have consented to this:

· We do not have the right to process sensitive personal data or details of crime within the framework of our customer administration. We may however process sensitive personal data if this is required for us to safeguard legal claims.

For the following purposes we process your personal data to fulfil legal obligations:

· We also process your personal data to the extent necessary to comply with applicable legislation, government decisions and any other legal obligations incumbent on relevant companies in the Bilia Group. For example we keep personal data about your contract with us to the extent necessary to comply with the prevailing Accounting Act.

Who has access to your personal data?

Your personal data is essentially processed only by relevant companies within the Bilia Group and by the Bilia Group’s internal IT company, Motorit AB. When we share personal data with relevant companies in the Bilia Group, in the vast majority of cases the company is the data processor for us, which means that the company processes your personal data on our behalf. For example we share your personal data with Bilia AB, who deals with marketing communication with you as a customer on our behalf. We also share personal data with other parties who are our data processors, such as suppliers that we use for data storage or other data management, payment services, distribution of goods or information, printing, marketing, or analyses. Data processors are not entitled to use any personal data, and Bilia has concluded data processing agreements with these suppliers.

We may pass on your personal data to government agencies because it is necessary or because they have a right to information, such as for de-registering vehicles from the Swedish Road Traffic Registry.

In addition, Bilia may disclose your personal data to the following parties who are themselves data controllers for their processing of your personal data:

· We may pass on your personal identity number and financial information to credit companies for credit checks.

· We may also pass on vehicle information to other companies in authorised auto salvage networks, so the network can offer customers the correct services.

· To provide you with a better customer experience, we may share your personal information with other companies within the Bilia Group.

· As a general rule, we only process your personal data within the EU / EEA. In cases where personal data is processed outside the EU / EEA, we ensure that your rights are protected by the transfer being covered by appropriate protection measures in accordance with the EU Data Protection Regulation. Appropriate protection measures may, for example, consist of the recipient country having an adequate level of protection or be ensured via EU-approved standard contractual clauses.

How long do we keep your personal data?

We never process your personal data for longer than is permitted under applicable law, regulations, practice or government decision. Personal data that we process for the purpose of fulfilling our contract with you is processed, as a base duration, for as long as is necessary for us to administer the contractual relationship and fulfil our obligations to you. We may however keep your personal data for longer, as per reasons specified below, in order to comply with mandatory law, because you have given your consent, or because we have the right to do so according to a balance of interests.

· For the purposes of accounting records, in line with the prevailing Accounting Act we keep data required by such law regarding our contract with you for a period of seven years.

· In accordance with prevailing legislation we have the right to store your contact details for direct marketing for a period of time following your purchase, or after our contract has come to an end. This period varies in duration depending on the subject of the contract.

o If your personal data has been retrieved from a party other than yourself and relates to contact details in your capacity as the representative of a company or organisation, we keep your contact details for marketing purposes for a maximum of three (3) months from the date of retrieval.

· In order to deal with any complaints, returns or warranty claims we save your name, contact details, vehicle registration number and details of your purchase for three (3) years from the date of purchase, or for the period covered by the warranty. The personal data is kept for three (3) years to manage your statutory right to return any goods you have purchased which are faulty.

· Material from CCTV cameras is kept for a maximum of seven days, and log files from using our network for a maximum of 60 days.

Your personal data may be kept for longer than stated above in so far as we are obliged to do so by law, regulations, or government decision.

Your rights

Below you will find a description of your rights regarding our processing of personal data. To exercise your rights regarding personal data, you are welcome to contact us (see contact information below). More information about your rights can be found on the national Data Protection Authority's website, [Enter URL].

Right to information

• You are entitled to be informed about how we process your personal data. We provide information regarding the process, for example, through this privacy policy, our websites, in certain documents you receive from us, via signs and decals and by answering questions from you.

The right to lodge a complaint

• If you have any complaints regarding our processing of your personal data, you have the right to lodge a complaint to the national Data Protection Authority's website [Enter URL].

Right to withdraw your consent

• You are entitled to revoke all or part of your consent to the processing of your personal data at any time. However, the revocation of your consent will not affect our processing of your personal data for the period before such revocation takes place.

Right to object

• You can object to your data being processed for marketing purposes and profiling. If you do object we will stop processing your data. You also have the right to object to your information being processed based on a weighing of interests.

Right of access

• You have the right to request information about what personal data we process about you and how the data is processed. You also have the right to request a copy of the personal data processed by us.

Right to rectification

• You have the right to have incorrect information corrected without undue delay and to ask us to complete incomplete information by providing us with correct information.

Right to erasure

• You have the right to request erasure of your personal data at any time, e.g. if the processing is no longer relevant in relation to the purpose for which the data was collected, if the processing is based on your consent and you revoke it, if processing takes place for direct marketing and you object to the data being processed or if you opposed processing based on a weighing of interests. However, we cannot delete the information in cases where the information is necessary for us to, for example, fulfil our agreement with you or to comply with applicable law.

Right to restriction

• In certain special situations, you can request that certain processing of your data be restricted, e.g. if you believe that information about you is incorrect and you have requested correction of your information or if you have objected to a processing and we investigate whether our interest outweighs your interest that the personal data is not processed.

Right to transfer your personal data (data portability)

• If you have given your consent or if we base the processing on an agreement with you, you have the right to obtain the personal data concerning you that you have provided to us in a structured, generally used and machine-readable format and transfer this to another personal data controller or get our help to transfer the data to another personal data controller when this is technically possible.

Contact details

If you wish to exercise your rights, you can write to Bilia at: Bilia Personbilar AB ATT: Customer Services, Ecris AB, Strömledningsgatan 11, SE-721 37 Västerås, Sweden; or send an e-mail to Bilia at Bilia.nu@bilia.se. If you have any questions about our processing of personal data, you are also welcome to contact us by phone on +46 (0)771-400 000 and ask for our data protection officer.

______________________

This privacy policy was adopted by Ecris AB on 15 June 2022