Introduction and purpose

This data protection policy contains information about how we handle and process personal data. Anyone who submits their personal data to us can read in this document how we process the data and what rights the data subjects have

The purpose of this policy is to ensure that we handle personal data in accordance with the EU’s General Data Protection Regulation (GDPR). The policy covers all processing where personal data is handled, both structured and unstructured data

Concepts and abbreviations

Personal data

All information relating to a living natural person, which can be directly or indirectly attributed to the person, is personal data. Example: Name, address, social security number, purchase history, e-mail, browser, picture, etc. Information about legal entities is not considered personal data

Registered

The person to whom a personal data refers is called the registered person, i.e. the natural person who can be directly or indirectly identified through the personal data in a register.

Personal data processing

An action or combination of actions regarding personal data. Example: Personal data is processed when collecting, booking, registering, storing, organizing and structuring personal data

Personal data controller

VareWeb is responsible for personal data. Address: 5400 Preston Oaks Rd, Dallas, TX 75254, United States
Telephone number: 659-200-6383

The personal data controller is responsible for ensuring that the processing of personal data complies with this policy (according to the principle of responsibility). The policy is determined by the person in charge of personal data at least once a year and updated as necessary. This policy applies to both customers and our employees.

Processing of personal data

Below is information about why, how and which personal data we collect and register.

Why we register personal data

We register personal data, so that we can fulfill the agreement and the assignment for which we have been hired (according to the principle of purpose limitation). The most common and necessary personal data we collect and register are: Name, social security number, e-mail, telephone number and address. Some personal data, such as contact details and

Data protection policy

VareWeb

delivery address, may be registered by us without first obtaining the Customer’s consent, as the Customer can be expected to understand that we need the data to: fulfill an assignment, carry out bookings, deliver the Services, keep records in accordance with the Accounting Act, etc. The receipt of personal data takes place primarily via telephone or e- e-mail correspondence with the customer and the information is treated carefully. The data is not shared with any other supplier or third party. If we want to register more personal data than is necessary to fulfill the contract or the assignment for which we have been hired, for example the Customer’s purchase history with us, we must first ask the Customer for permission and obtain an approval.

How we obtain a legal basis for the processing of personal data

In order for us to have the right to use personal data, it is required that we have a so-called “legal basis” (according to the principle of legality, correctness and transparency). We obtain a legal basis through:

• Consent from the customer (the customer agrees that we process his personal data).
• Agreement with Customer (The Customer is considered to have indirectly understood and accepted that processing of his personal data will take place, in order for us to be able to fulfill the agreement).
• That the information is necessary for us to fulfill legal obligations (e.g. Bookkeeping).

Personal data about a former customer may be used for marketing purposes for a period of one year after the customer relationship has ended. Thinning of personal data takes place at least once a year. We try to work primarily through the principle of task minimization, i.e. by processing only the data that is necessary, adequate and relevant for each individual purpose.

Complaint

Any complaints about our processing of personal data must be submitted to the US Data Protection Authority.

Rights of data subjects

The most important rights for the registered are that they have the right to receive free of charge:

• access to their personal data
• incorrect personal data corrected
• their personal data deleted
• object to the personal data being used for direct marketing and profiling

Please contact us if you want any of the above to be carried out regarding your personal data

Personal data incidents

Any incidents concerning personal data that we process must be reported to our personal data manager without delay. A personal data incident is, for example, a data breach or something else that means we lose control over the data we process. All such events must be documented. The person in charge of personal data must report the incident to the Data Protection Authority within 72 hours at the latest