Information pursuant to Article 14 of the General Data Protection Regulation (EU) 2016/679 (GDPR)
Version: 1.1
1. Why you are receiving this notice
Your company is a business partner of one of our customers, which has invited your company to take part in an initiative run through a digital platform. Because the personal data used was not always collected directly from you, we provide this information in accordance with Article 14 of the GDPR.
This notice covers two separate things: the initiative your company was invited to, described in sections 2 to 5 and 7 to 11, and the service improvement surveys DigiProc runs on its own behalf, described in section 6.
2. Who is responsible for your personal data
Data controller. The controller is the customer that invited your company to the initiative, named in the invitation email you received (the "Customer"). The Customer decides which companies are contacted and for what purpose.
Data processor. DigiProc Solutions AB operates the platform on the Customer's behalf as a data processor, and processes your personal data only on the Customer's documented instructions under a data processing agreement.
For one purpose DigiProc acts as a controller in its own right rather than as a processor. That processing is described separately in section 6.
3. What personal data we process
In connection with the initiative, we process business-related personal data about you in your professional capacity as a contact person at your company, including:
- Identity and business contact data: your name, job title or role, business email address and business phone number.
- Company data: your employer's name, organisation number, country and preferred language.
- Engagement and technical data: whether and when invitation emails were delivered, opened and clicked, your log-ins and activity in the supplier portal, the responses, offers, messages and documents you submit during the negotiation, and related access timestamps.
4. Where we obtained your personal data
Where your personal data was not provided directly by you, it comes from one or more of the following sources:
- From the Customer: its business partner and accounts-payable records relating to your company.
- From a contact-gathering process carried out on the Customer's behalf, using your company's own website and other publicly available business sources, and third-party business-contact and email-verification providers.
- From your interactions with the invitation emails and the supplier portal.
5. Why we process your data and the legal basis
Your personal data is processed to invite your company to the initiative and reach the correct contact person, to run and administer the negotiation, to keep contact data accurate, to produce results and reporting for the Customer, to provide support, and to meet security, audit and legal obligations.
Legal basis. The processing is based on legitimate interests (Article 6(1)(f) GDPR). Those interests are the Customer's and your employer's interest in managing their commercial relationship and running initiatives with the correct contact person. You may object to this processing (see section 10).
6. Service improvement surveys run by DigiProc
DigiProc as controller. Separately from the initiative described above, DigiProc Solutions AB may invite you to answer a few short questions about how price requests and the supplier portal work from your side. For this processing DigiProc is the controller in its own right and not a processor: DigiProc decides to run the survey, decides what it asks, and uses the answers for its own purposes. The Customer does not instruct us to run it and is not involved in it.
Purpose. To understand how companies experience invitations, price requests and the supplier portal, and to improve the service on the basis of what we learn. The answers are used for service development only. They are never used for sales, and the list of contacts invited is not reused for any other purpose.
What we process. Your name and business email address, your employer's name and your preferred language; a single-use code in the link that identifies your invitation; the answers you choose to give, including anything you write in a free text field; and the time an answer reached us. We do not record opens, reads or page views for this purpose.
Where it comes from. The same contact data described in section 4. We do not ask the Customer for anything further in order to run a survey.
Legal basis. Legitimate interests (Article 6(1)(f) GDPR). The interest is our own interest in improving a service that companies are asked to use. Taking part is voluntary, and not answering has no consequence of any kind. No answer you give reaches the Customer, affects your company's relationship with it, or affects any negotiation. You may object to this processing at any time, and we will stop it (see section 10).
Confidential, but not anonymous. Your answers are stored linked to your invitation, so they are not anonymous. They are held confidentially by DigiProc: they are not disclosed to the Customer or to any other customer, and nothing we report to a customer identifies you or your company.
How long we keep it. The list that connects an invitation code to a named contact is kept only while the survey is open, and is deleted when it closes. Once it is deleted the remaining answers can no longer be attributed to you or to your company, and we keep them in that form to inform how the service develops.
Opting out, and having an answer deleted. You can decline simply by not answering. To be taken off the list, or to have an answer you have already given deleted, email [email protected] or reply to the invitation you received. For these surveys we act on our own behalf, so your request is not passed on to the Customer.
7. Who we share your data with
Your personal data may be shared with:
- the Customer (the controller);
- DigiProc Solutions AB (the processor), and its sub-processors in the following categories: cloud hosting and infrastructure, email delivery, email verification and contact data, and monitoring and error tracking;
- professional advisers, auditors and authorities where required by law.
8. International transfers
DigiProc is established in Sweden (EU/EEA). Where personal data is transferred outside the EEA, for example because a sub-processor operates there, we rely on the European Commission's Standard Contractual Clauses. A copy is available on request.
9. How long we keep your data
We do not apply a fixed retention period. Your personal data is stored for as long as your company is registered as a business partner of the Customer and the Customer has an ongoing need for the outcome of the initiative, and thereafter for the period required by applicable accounting, tax and limitation rules. When these criteria no longer apply, the data is deleted or anonymised.
Personal data processed for service improvement surveys is kept as described in section 6.
10. Your rights
Subject to the conditions in the GDPR, you have the right to request access to your personal data, rectification, erasure or restriction of processing, to object to processing based on legitimate interests, including being contacted about initiatives, and, where applicable, data portability.
To exercise your rights, contact DigiProc at [email protected]. We handle these requests on behalf of the Customer, except for requests concerning the surveys in section 6, where we act as controller in our own right. Either way we will register your request and act on it.
11. How to complain
If you have concerns about how your personal data is handled, please contact DigiProc at [email protected] first so we can help. You also have the right to lodge a complaint with a data protection supervisory authority, your local authority, or in Sweden the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se).
