1. General

• What we do: We use your personal data to provide, administer and develop our products and services, and to provide customer service to you as our customer, e.g., in the event of complaints and quality matters.
• Categories of personal data:
  Contact details such as name, title/role of the supplier or customer, telephone number and e-mail address. Login details when applicable such as e-mail address and password.
• Legal basis: Performance of a contract.
• Retention period: The personal data is retained for the duration of the contractual relationship and for up to 12 months after the termination of the contract. If contact details are available in relation to invoice documentation, we will retain your personal data for seven years after terminated financial year in accordance with

• What we do: We process your personal data as a contact person within our customer’s organisation to handle any complaints and warranty matters when, in addition to fulfilling our agreement with you, we have a legal obligation to tend to a warranty matter.
• Categories of personal data:
  Contact details such as name, title/role within the supplier or customer, telephone number and e-mail address.
  Login details when applicable such as e-mail address and password.
• Legal basis:
  Legal obligation.
• Retention period:
  The personal data is retained for the duration of the warranty matter or complaint and for up to 12 months after the matter was terminated or any longer period of time required pursuant to applicable legislation.

• What we do:
  We process your personal data for marketing purposes. Our marketing activities may include newsletters, or other mailings of information about new products or special offers. Targeted marketing may entail, for example, that we analyse your use of our services and products such as when you usually make purchases and tailor our marketing measures based on such individual insights.
  When you previously have been a customer with us, we may send out e-mails with marketing messages to you without asking for your consent, but you are always given the opportunity to unsubscribe from such mailing, so-called “opt-out”.
• Categories of personal data:
  Contact details such as name, telephone number and e-mail address.
  Browsing habits and visit history such as the pages you have visited on our (and other) websites and the duration of your visit.
• Legal basis:
  Legitimate interest as we assess that our interest in sending you maketing and information outweighs your interests or fundamental rights and freedoms demanding protection of personal data.
• Retention period:
  The personal data is stored and used throughout the contractual relationship and up to 12 months after the contractual relationship ends.
  If you request to unsubscribe, we will immediately cease processing your personal data.

• What we do:
  We use your personal data, such as data derived from statistical compilations, market segmentations and customer satisfaction surveys for the purposes of conducting market and customer analyses. The results of our analyses are used for improving, replacing and developing new products and services, processes or working methods with the goal of developing our business and constantly improving in meeting our customers expectations and needs. For example, we may process your personal data to improve our customer service, to offer new solutions or to adapt our website and/or app in accordance with our customers’ preferences. We always pseudonymise, and if possible anonymise, the personal data we process to the greatest extent possible for achieving the purpose of the processing.
• Categories of personal data:
  Contact details such as name, telephone number and e-mail address.
  Browsing habits and visit history such as the pages you have visited on our (and other) websites and the duration of your visit.
• Legal basis:
  Legitimate interest as we assess that our interest in developing our business to better meet our customers expectations and needs outweighs your interests or fundamental rights and freedoms requiring protection or personal data.
• Retention period:
  The personal data is stored and used throughout the contractual relationship and up to 12 months after the contractual relationship ends.

• What we do:
  In the event of a dispute, such as a payment dispute, we have the right to use your data for the purpose of establishing, defending or enforcing the legal claim.
• Categories of personal data:
  Contact details such as name, social security number, telephone number and e-mail address.
  Login details where applicable, such as e-mail address and password.
• Legal basis:
  Legitimate interest as we assess that our interest in defending our interests in the event of a dispute outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
• Retention period:
  Your personal data is retained for as long as necessary for us to exercise or defend a reasonable expected legal claim in case of a dispute within the foreseeable future.

• What we do:
  If Boule is to be restructured, e.g. divided into several different businesses, or if a third party acquires Boule or our customer database, Boule will disclose your personal data and that of other customers to the acquiring company. That company will continue to use your personal information for the same purposes as those stated in this Privacy Notice, unless you are informed otherwise in connection with the transaction. The acquiring company will then, as the new data controller, inform you of its processing of your personal data.
• Categories of personal data:
  Contact information such as name, telephone number and e-mail address.
  User data such as behavior patterns and browsing habits, such as pages you have visited on our website and the duration of your visit.
  Device data such as IP number.
  Location data such as information about your location when you visit our website.
  Other information that you choose to share.
• Legal basis:
  Legitimate interest as we assess that our interest in enabling an acquisition or restructuring process, assuming that the acquiring company carries out similar operations as Boule, outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
• Retention period:
  If Boule ceases to exist, e.g. through a merger, liquidation or bankruptcy, or if Boule´s customer database is transferred to an acquiring company, we will erase the personal data as long as the retention of such personal data is not required by law. In such case your personal data will be processed in accordance with this Privacy Notice.

• What we do:
  We process your personal data to provide, administer and manage our website for the benefit of you and other website visitors. We do this primarily by retrieving information from cookies.
  In order for us to be able to offer you a good service when you visit our website, we may also process information about you if you, for example, choose to contact us or to subscribe to our newsletters.
• Categories of personal data:
  Contact information such as name, telephone number and e-mail address.
  User data such as behavior patterns and browsing habits, such as pages you have visited on our website and the duration of your visit.
  Device data such as IP number.
  Other information that you choose to share.
• Legal basis:
  Legitimate interest as we assess that our interest of providing, administering and manage our website outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
• Retention period:
  The personal data is stored for as long as it is necessary for us to be able to provide, administer and manage our website. If you contact us with, for example, a question about our services, we process your personal data while your case is being processed and up to 2 months thereafter.

• What we do:
  We process your personal data to analyze, improve and develop our website.
  For this purpose, we also use third-party tools to collect aggregated data about visitors to our website.
• Categories of personal data:
  User data such as behavior patterns and browsing habits, such as pages you have visited on our website and the duration of your visit.
  Location data such as information about your location when you visit our website.
  Device data such as IP number.
• Legal basis:
  When using other than necessary cookies, we always obtain your consent, please see our cookie policy for more information.
• Retention period:
  Please see our cookie policy.

• What we do:
  If Boule is to be restructured, e.g. divided into several different businesses, or if a third party acquires Boule or our customer database, Boule will disclose your personal data and that of other customers to the acquiring company. That company will continue to use your personal information for the same purposes as those stated in this Privacy Notice, unless you are informed otherwise in connection with the disclosure. The acquiring company will then, as the new data controller, inform you of its processing of your personal data.
• Categories of personal data:
  Contact information such as name, telephone number and e-mail address.
  User data such as behavior patterns and browsing habits, such as pages you have visited on our website and the duration of your visit.
  Device data such as IP number.
  Location data such as information about your location when you visit our website.
  Other information that you choose to share.
• Legal basis:
  Legitimate interest as we assess that our interest in enabling an acquisition or restructuring process, assuming that the acquiring company carries out similar operations as Boule, outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
• Retention period:
  If Boule ceases to exist, e.g. through a merger, liquidation or bankruptcy, we will erase the personal data as long as the retention of such personal data is not required by law. In such case your personal data will be processed in accordance with this Privacy Notice.

• What we do: We process job applicants’ personal data to manage recruitment processes. The recruitment process includes reviewing employment applications, interviewing relevant candidates and obtaining references for relevant candidates.

• Categories of personal data:
  Contact information such as name, telephone number and e-mail address.
  Application documents such as CV, personal letter, grades, and certificates.
  Contact information for the people you have provided as references.
  Notes and similar records from job interviews.
• Legal basis:
  Legitimate interest as we assess that our interest in administering employment applications for the purpose of hiring staff outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
• Retention period:
  The personal data is saved until a recruitment process is completed and another 2 years thereafter.

• What we do:
  If Boule is to be restructured, e.g. divided into several different businesses, or if a third party acquires Boule, Boule will disclose your personal data and that of other customers to the acquiring company. That company will continue to use your personal information for the same purposes as those stated in this Privacy Notice, unless you are informed otherwise in connection with the disclosure. The acquiring company will then, as the new data controller, inform you of its processing of your personal data.
• Categories of personal data:
  Contact information such as name, telephone number and e-mail address.
  Application documents such as CV, personal letter, grades and certificates.
  Contact information for the people you have provided as references.
  Notes and similar records from job interviews.
• Legal basis: Legitimate interest as we assess that our interest in enabling an acquisition or restructuring process, assuming that the acquiring company carries out similar operations as Boule, outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
• Retention period: If Boule ceases to exist, e.g. through a merger, liquidation or bankruptcy, or if Boule´s customer database is transferred to an acquiring company, we will erase the personal data as long as the retention of such personal data is not required by law. In such case your personal data will be processed in accordance with this Privacy Notice.

• What we do:
  We process your personal data to keep a share register and fulfill other obligations we have as a company listed on a regulated market, such as to handle your personal data if you register and participate in a general meeting.
• Categories of personal data:
  Contact information such as name, telephone number and e-mail address.
  Social security number or organization number (if sole proprietorship).
  Your number of held shares.
• Legal basis:
  Legal obligation.
• Retention period:
  We save your personal data for as long as it is necessary to fulfill the legal obligation. For example, personal data that is kept in our share register is retained for 10 years after you have been removed from the share register.

We may share your data with:

• Suppliers of IT systems and administrative services such as payment services.
• Purchaser or other successor in the event of mergers, divestitures, restructuring, reorganization, dissolution and other sales or transfers of Boule’s assets.
• Authority or equivalent third party in connection with audits, court proceedings or for other similar reasons. This is to fulfill legal obligations and be able to safeguard our legal interests in the event of a dispute.

Categories of personal data that are shared:

• Contact information to you as a supplier, consultant or customer, such as name, telephone number, postal address and e-mail address.
• All categories listed in section 5 attributable to suppliers, consultants and customers.
• All categories listed in section 5 attributable to suppliers, consultants and customers.

We may share your data with:

• Providers of third-party cookies such as Google Analytics.
• Purchaser or other successor in the event of mergers, divestitures, restructuring, reorganization, dissolution and other sales or transfers of Boule’s assets.

Categories of personal data that are shared:

• User data such as behavior patterns and browsing habits, such as pages you have visited on our website and the duration of your visit.
  Location data such as information about your location when you visit our website.
  Device data such as IP number.
• All categories listed in section 5 attributable to website visitors.

We may share your data with:

• Reference persons to whom you provided contact information in connection with the hiring process.

Categories of personal data that are shared:

• Information that you have provided in your application documents such as CV, personal letter, grades and certificates or in an interview with us.
• All categories listed in section 5 attributable to job-applicants.

We may share your data with:

• Suppliers who administer our company documentation, including share registers kept by Euroclear.

Categories of personal data that are shared:

• Contact information such as name, telephone number and e-mail address.
  Social security number or organization number (if sole proprietorship).
  Your number of shares held.

12.1 Your right to access, rectification, erasure and restriction
12.1.1 In accordance with applicable personal data legislation, you have the right, at any time, to request access to the personal data which is processed about you, to get erroneous personal data corrected, to get Boule to stop processing and delete your personal data, to restrict the processing of your personal data, to exercise your right to data portability and to object to the processing of personal data. In such cases, please contact Boule at the address given below.

12.1.2 We have an obligation to respond to your requests to exercise your rights within one month from receiving your request. If your request is complex or if we have received many requests, we have the right to extend this deadline by two more months. If we are unable to take the action you have requested within one month, we will inform you of the reason for the delay and of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy.
12.1.3 You will not be charged for any information, communication or measures that we implement. However, if your request is manifestly unfounded or excessive, we may charge an administrative fee for providing the information or taking the action requested or refuse to act on your request altogether.

12.2 Your right to access, rectification, erasure and restriction
12.2.1 You have the right to request:

a) Access to your personal data. This means that you have the right to request access to personal data that we hold about you. You also have the right to be provided, at no cost, with information about which personal data we are processing about you. We have the right to charge a reasonable administration fee if you request further copies. If you make a request by electronic means, e.g. via email, we will provide you with the information in commonly used electronic format.
b) Rectification of your personal data. At your request or on our own initiative, we will correct, anonymize, delete or complete data that we know to be inaccurate, incomplete or misleading. Also, you have the right to complete any incomplete personal data if something relevant is missing.
c) Erasure of your personal data: You have the right to request that we erase your personal data if there is no compelling reason for us to continue processing the data. Compelling reasons for use to continue processing may be:
i. Processing is necessary for the right of freedom of expression and information,
ii. Processing is necessary to comply with a legal obligation,
iii. Processing is necessary for reasons of public interests in the area of public health,
iv. Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or
v. Processing is necessary for the establishment, exercise or defense of legal claims.
Your personal data will be erased if none of the circumstances above are applicable and if:
vi. The personal data is no longer needed for the purpose for which we collected them,
vii. We process your personal data based on your consent and you withdraw your consent,
viii. You object to us processing your personal data which is based on a legitimate interest assessment, and we have no compelling interests that overrides your interests or rights and freedoms,
ix. We have processed the personal data unlawfully, or
x. We have a legal obligation to erase the personal data.
d) Right to restrict processing. This means that we temporarily restrict the processing of your data. You have the right to request restriction when:
i. You consider your data to be inaccurate and you have requested rectification as defined in b), while we establish the accuracy of the personal data,
ii. The processing is unlawful, and you do not want the data to be erased,
iii. As data controller, we no longer need to process the personal data for our processing purposes, but you need them to be able to establish, exercise or defend a legal claim, or
iv. You have objected to processing as defined in 12.3, while waiting for our assessment of whether our legitimate interests override yours.
12.2.2 We will take all reasonable measures possible to notify everyone who has received personal data as stated in section 9 above if we have rectified, erased or restricted access to your personal data after you have requested us to do so. At your request, we will provide you with more information about the recipients of your personal data.

12.3 Your right to object to processing
12.3.1 You have the right to object to the processing of your personal data if our processing is based upon legitimate interest (see section 5 above). If you object to such processing, we will only continue to process your data if we have compelling reasons for doing so that override your interests or rights and freedoms or if the processing is necessary for the establishment, exercise or defense of legal claims.
12.3.2 If you do not wish that we use your personal data for direct marketing purposes, you always have the right to object to such processing by contacting us. We will cease to use your personal data for that purpose when we have received your objection.

12.4 Your right to withdraw consent
12.4.1 For the processing of your personal data we do based on your consent as the legal basis (see section 5 above), you always have the right to withdraw your consent. In connection with you giving your consent, we will always inform you on how to withdraw it. Our contact details are found in the end of this Privacy Notice.

12.5 Your right to data portability
12.5.1 You have the right to data portability. This means the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to have this personal data directly transferred to another data controller, provided that it is technically possible. You only have the right to data portability when the processing of your personal data is automated, and we base our processing on your consent or on an agreement between you and Boule.