Privacy Policy
1. General
1.1 Boule Diagnostics AB (publ) and its group companies (“Boule”) is committed to protecting your personal privacy, and this Privacy Notice (“Privacy Notice”) explains how we collect and use your personal data.
1.2 Our mission is to help you feel confident that your privacy is respected and that your personal information is processed correctly. We take responsibility for ensuring that the personal data processed by Boule is used only for the intended purpose and is protected against unauthorized access. All processing of personal data at Boule is carried out in accordance with applicable personal data legislation. As of 25 May 2018, the General Data Protection Regulation (GDPR) is in force within the EU/EEA.
2. Data controller and scope
2.1 Boule Diagnostics AB (publ), org.no. 556535-0252, is the data controller for the processing of your personal data and is thus responsible for ensuring that the processing of personal data complies with applicable legislation. You can find our contact details in the end of this Privacy Notice.
2.2 This Privacy Notice is applicable to all processing of personal data in relation to our (i) suppliers, consultants, and customers, (ii) website visitors, (iii) job-applicants and (iv) investors, when we act as data controller. In section 5 and 9 we describe how we process personal data, and which personal data we may transfer, in relation to each group of registrants.
3. What is personal data and what is the processing of personal data?
3.1 Personal data is any information that directly or indirectly, together with other information, can be connected to a natural person. For example, your name, email address, address and IP addresses constitute personal data.
4. From where do we collect your personal data?
4.1 We collect the information you provide to us. You may give us information about yourself directly or indirectly in a number of ways, such as when you send us an email when signing agreements and when you apply for work at Boule.
5. Our processing of personal data
5.1 Boule always processes your personal data in accordance with applicable legislation. We process your personal data when it is necessary to fulfill an agreement with you or when we have another legitimate and justified interest in processing your personal data. When we apply the legal basis legitimate interest, it means that the processing is necessary to satisfy our legitimate interest, for example, in order to be able to offer you training and product information. If Boule should process your personal data for any purpose that, according to applicable legislation, requires your consent, we will obtain your consent in advance, by allowing you to actively check a box or sign a form.
5.2 More information about our processing of personal data is provided in the tables below, divided into groups of registrants, including information about why we process your personal data, what personal data we process to achieve those purposes and for how long we retain your personal data for each specified purpose.
Administration and performance of contracts
What we do
We use your personal data to provide, administer and develop our products and services, and to provide customer service to you as our customer, e.g., in the event of complaints and quality matters.
Categories of personal data
Contact details such as name, title/role of the supplier or customer, telephone number and e-mail address.
Login details when applicable such as e-mail address and password.
Legal basis
Performance of a contract.
Retention period
The personal data is retained for the duration of the contractual relationship and for up to 12 months after the termination of the contract. If contact details are available in relation to invoice documentation, we will retain your personal data for seven years after terminated financial year in accordance with applicable accounting legislation.
Collection of information for warranty matters and complaints
What we do
We process your personal data as a contact person within our customer’s organisation to handle any complaints and warranty matters when, in addition to fulfilling our agreement with you, we have a legal obligation to tend to a warranty matter.
Categories of personal data
Contact details such as name, title/role within the supplier or customer, telephone number and e-mail address.
Login details when applicable such as e-mail address and password.
Legal basis
Legal obligation.
Retention period
The personal data is retained for the duration of the warranty matter or complaint and for up to 12 months after the matter was terminated or any longer period of time required pursuant to applicable legislation.
Marketing activities
What we do
We process your personal data for marketing purposes. Our marketing activities may include newsletters, or other mailings of information about new products or special offers. Targeted marketing may entail, for example, that we analyse your use of our services and products such as when you usually make purchases and tailor our marketing measures based on such individual insights.
When you previously have been a customer with us, we may send out e-mails with marketing messages to you without asking for your consent, but you are always given the opportunity to unsubscribe from such mailing, so-called “opt-out”.
Categories of personal data
Contact details such as name, telephone number and e-mail address.
Browsing habits and visit history such as the pages you have visited on our (and other) websites and the duration of your visit.
Legal basis
Legitimate interest as we assess that our interest in sending you marketing and information outweighs your interests or fundamental rights and freedoms demanding protection of personal data.
Retention period
The personal data is stored and used throughout the contractual relationship and up to 12 months after the contractual relationship ends.
If you request to unsubscribe, we will immediately cease processing your personal data.
Business development
What we do
We use your personal data, such as data derived from statistical compilations, market segmentations and customer satisfaction surveys for the purposes of conducting market and customer analyses. The results of our analyses are used for improving, replacing and developing new products and services, processes or working methods with the goal of developing our business and constantly improving in meeting our customers expectations and needs. For example, we may process your personal data to improve our customer service, to offer new solutions or to adapt our website and/or app in accordance with our customers’ preferences. We always pseudonymise, and if possible anonymise, the personal data we process to the greatest extent possible for achieving the purpose of the processing.
Categories of personal data
Contact details such as name, telephone number and e-mail address.
Browsing habits and visit history such as the pages you have visited on our (and other) websites and the duration of your visit.
Legal basis
Legitimate interest as we assess that our interest in developing our business to better meet our customers expectations and needs outweighs your interests or fundamental rights and freedoms requiring protection or personal data.
Retention period
The personal data is stored and used throughout the contractual relationship and up to 12 months after the contractual relationship ends.
In case of dispute
What we do
In the event of a dispute, such as a payment dispute, we have the right to use your data for the purpose of establishing, defending or enforcing the legal claim.
Categories of personal data
Contact details such as name, social security number, telephone number and e-mail address.
Login details where applicable, such as e-mail address and password.
Legal basis
Legitimate interest as we assess that our interest in defending our interests in the event of a dispute outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
Retention period
Your personal data is retained for as long as necessary for us to exercise or defend a reasonable expected legal claim in case of a dispute within the foreseeable future.
Mergers and acquisitions, restructuring, etc.
What we do
If Boule is to be restructured, e.g. divided into several different businesses, or if a third party acquires Boule or our customer database, Boule will disclose your personal data and that of other customers to the acquiring company. That company will continue to use your personal information for the same purposes as those stated in this Privacy Notice, unless you are informed otherwise in connection with the transaction. The acquiring company will then, as the new data controller, inform you of its processing of your personal data.
Categories of personal data
Contact information such as name, telephone number and e-mail address.
User data such as behavior patterns and browsing habits, such as pages you have visited on our website and the duration of your visit.
Device data such as IP number.
Location data such as information about your location when you visit our website.
Application documents such as CV, personal letter, grades and certificates. Contact information for the people you have provided as references. Notes and similar records from job interviews.
Other information that you choose to share.
Legal basis
Legitimate interest as we assess that our interest in enabling an acquisition or restructuring process, assuming that the acquiring company carries out similar operations as Boule, outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
Retention period
If Boule ceases to exist, e.g. through a merger, liquidation or bankruptcy, or if Boule’s customer database is transferred to an acquiring company, we will erase the personal data as long as the retention of such personal data is not required by law. In such case your personal data will be processed in accordance with this Privacy Notice.
Provision, administration and management of Boule’s website
What we do
We process your personal data to provide, administer and manage our website for the benefit of you and other website visitors. We do this primarily by retrieving information from cookies.
In order for us to be able to offer you a good service when you visit our website, we may also process information about you if you, for example, choose to contact us or to subscribe to our newsletters.
Categories of personal data
Contact information such as name, telephone number and e-mail address.
User data such as behavior patterns and browsing habits, such as pages you have visited on our website and the duration of your visit.
Device data such as IP number.
Other information that you choose to share.
Legal basis
Legitimate interest as we assess that our interest of providing, administering and manage our website outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
Retention period
The personal data is stored for as long as it is necessary for us to be able to provide, administer and manage our website. If you contact us with, for example, a question about our services, we process your personal data while your case is being processed and up to 2 months thereafter.
Website development
What we do
We process your personal data to analyze, improve and develop our website.
For this purpose, we also use third-party tools to collect aggregated data about visitors to our website.
Categories of personal data
User data such as behavior patterns and browsing habits, such as pages you have visited on our website and the duration of your visit.
Location data such as information about your location when you visit our website.
Device data such as IP number.
Legal basis
When using other than necessary cookies, we always obtain your consent, please see our cookie policy for more information.
Retention period
Please see our cookie policy.
Mergers and acquisitions, restructuring, etc.
What we do
If Boule is to be restructured, e.g. divided into several different businesses, or if a third party acquires Boule or our customer database, Boule will disclose your personal data and that of other customers to the acquiring company. That company will continue to use your personal information for the same purposes as those stated in this Privacy Notice, unless you are informed otherwise in connection with the transaction. The acquiring company will then, as the new data controller, inform you of its processing of your personal data.
Categories of personal data
Contact information such as name, telephone number and e-mail address.
User data such as behavior patterns and browsing habits, such as pages you have visited on our website and the duration of your visit.
Device data such as IP number.
Location data such as information about your location when you visit our website.
Application documents such as CV, personal letter, grades and certificates. Contact information for the people you have provided as references. Notes and similar records from job interviews.
Other information that you choose to share.
Legal basis
Legitimate interest as we assess that our interest in enabling an acquisition or restructuring process, assuming that the acquiring company carries out similar operations as Boule, outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
Retention period
If Boule ceases to exist, e.g. through a merger, liquidation or bankruptcy, or if Boule’s customer database is transferred to an acquiring company, we will erase the personal data as long as the retention of such personal data is not required by law. In such case your personal data will be processed in accordance with this Privacy Notice.
Recruitment process
What we do
We process job applicants’ personal data to manage recruitment processes. The recruitment process includes reviewing employment applications, interviewing relevant candidates and obtaining references for relevant candidates.
Categories of personal data
Contact information such as name, telephone number and e-mail address.
Application documents such as CV, personal letter, grades, and certificates.
Contact information for the people you have provided as references.
Notes and similar records from job interviews.
Legal basis
Legitimate interest as we assess that our interest in administering employment applications for the purpose of hiring staff outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
Retention period
The personal data is saved until a recruitment process is completed and another 2 years thereafter.
Mergers and acquisitions, restructuring, etc.
What we do
If Boule is to be restructured, e.g. divided into several different businesses, or if a third party acquires Boule or our customer database, Boule will disclose your personal data and that of other customers to the acquiring company. That company will continue to use your personal information for the same purposes as those stated in this Privacy Notice, unless you are informed otherwise in connection with the transaction. The acquiring company will then, as the new data controller, inform you of its processing of your personal data.
Categories of personal data
Contact information such as name, telephone number and e-mail address.
User data such as behavior patterns and browsing habits, such as pages you have visited on our website and the duration of your visit.
Device data such as IP number.
Location data such as information about your location when you visit our website.
Application documents such as CV, personal letter, grades and certificates. Contact information for the people you have provided as references. Notes and similar records from job interviews.
Other information that you choose to share.
Legal basis
Legitimate interest as we assess that our interest in enabling an acquisition or restructuring process, assuming that the acquiring company carries out similar operations as Boule, outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
Retention period
If Boule ceases to exist, e.g. through a merger, liquidation or bankruptcy, or if Boule’s customer database is transferred to an acquiring company, we will erase the personal data as long as the retention of such personal data is not required by law. In such case your personal data will be processed in accordance with this Privacy Notice.
Share register and other regulatory obligations
What we do
We process your personal data to keep a share register and fulfill other obligations we have as a company listed on a regulated market, such as to handle your personal data if you register and participate in a general meeting.
Categories of personal data
Contact information such as name, telephone number and e-mail address.
Social security number or organization number (if sole proprietorship).
Your number of held shares.
Legal basis
Legal obligation.
Retention period
We save your personal data for as long as it is necessary to fulfill the legal obligation. For example, personal data that is kept in our share register is retained for 10 years after you have been removed from the share register.
6. Automated decision-making
6.1 We do not use automated decision-making.
7. Retention of personal data
7.1 We will only retain your personal data for as long as it is needed for the purposes we collected the personal data as described in this Privacy Notice. When we no longer need your personal data, we will remove the personal data from our systems and databases, including any back-ups. More specific retention periods for each purpose are provided in the tables in section 5 above under the heading “Retention period”.