The purpose of this privacy notice is to provide information on how Heidelberg Materials Sverige AB and Heidelberg Materials Norge AS (jointly named “HM” or “we”) process and use the personal data collected from you in connection with your visit on this website and your use of the website’s functions.
HC, which are companies within the Heidelberg Materials Group, respects your privacy and the protection of your personal data. All processing of personal data is carried out in accordance with the European Union’s General Data Protection Regulation (the “GDPR”). This privacy notice also contains information on how you can contact us with questions about our processing of your personal data.
2. Purpose and legal basis for the processing of your personal data
Below is a description of what personal data we process about you, for which purposes we process your personal data and which legal bases we base our processing of your personal data on.
To answer your requests
(i) What personal data being processed and why?
To answer requests from you, we process your name, e-mail address and telephone number as well as other personal data that you may leave in connection with your request.
(ii) What is the legal basis for the processing?
The processing of your personal data for this purpose is based on our legitimate interest to provide you with good service and to be able to answer your request. When you contact us with a request, it is also in your interest that we process your personal data in order to provide you with the information and service that you have requested. Furthermore, the personal data we process in connection with your request is of non-sensitive character and is necessary for us to be able to satisfy and answer your request. Personal data is only shared with third parties if it is required to answer your request.
To contact you for marketing purposes and as part of our follow-up of customer relations
(i) What personal data is being processed and why?
To contact you for marketing purposes and as part of our follow-up of customer relations, we process your name and e-mail address.
(i) What is the legal basis for the processing?
The processing of your personal data for this purpose is based on our legitimate interest of marketing our business and maintaining a good relation with you as a customer or representative of a corporate customer. Marketing is a fundamental part of our business and we always strive to provide marketing that is relevant to you. It is also in our interest to maintain, manage and grow the relationship we have with you (or the company you represent) as a customer.
To manage and improve this website, for our internal information gathering and for statistical analysis
(i) What personal data is being processed and why?
We process personal data collected using cookies. For further information about which cookies we use and what information they collect, see our Cookie policy.
(ii) What is the legal basis for the processing?
The processing of personal data through the use of so-called necessary cookies is necessary for us to fulfil the agreement with you regarding the use of our website, i.e. without the processing of such cookies we cannot provide you with a functioning website. Processing of personal data collected using other types of cookies is based on your explicit consent. For more information, see our Cookie policy.
3. Who has access to your personal data?
We have taken appropriate technical and organisational security measures to protect your personal data against loss, unintentional and unauthorized access and unauthorized disclosure. The number of persons that have access to your personal data is limited. Only persons at HC that needs to process your personal data in accordance with the purposes stated above have access to the personal data.
We may share your personal data with other companies within the HeidelbergMaterials Group if required to fulfil the purposes mentioned above. Such Heidelberg Materials companies may be located within or outside the EU/EEA.
We may also share your personal data with third parties under the following scenarios:
When required by law;
to HC’s service providers which perform services on our behalf in connection with this website and its functions (for example, our IT services provider that provides, develops and supports the website). Your personal data will only be shared with such service providers to the extent necessary to provide this website; and
to a buyer or a potential buyer of our business.
HC will take measures to protect all personal data transferred to such third party.
Your personal data may be transferred to countries that might have a lower level of protection of personal data than that offered within the EU/EEA. When your personal data is transferred to countries outside the EU/EEA, we use standard contractual clauses that have been approved by the European Commission to ensure an adequate level of protection for your personal data. The standard contractual clauses are available via the following link: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en.
4. For how long do we store your personal data?
We store your personal data for as long as is necessary to fulfil the purpose for which it was collected. This means that we store your personal data in accordance with the table below. Statistics that have been anonymised and no longer can be attributed to you may be stored for a longer period of time.
Type of processing
Time period or criterion for determining the storage period
Personal data collected to answer requests from you.
During the time we process your request.
Personal data being processed to contact you for marketing purposes and as part of our follow-up of customer relations.
Until you object to the marketing.
Personal data collected using cookies to manage and improve this website, for our internal information collection and for statistical analysis.
Stored for the duration of each cookie, for more information see our Cookie policy.
5. What are your rights?
Heidelberg Materials Sverige AB (556000-6057) and Heidelberg Materials Norge AS (980 910 369), are jointly data controllers of the processing of your personal data described in this privacy notice. This means that we are responsible for ensuring that your personal data is processed correctly and in accordance with applicable laws. Read more about your rights below.
The right of access: You have the right to know which personal data we process about you, for what purposes the personal data is processed and who we share personal data with, etc. You also have the right to access the personal data and request a copy of the personal data being processed.
The right to rectification: If you notice that we have incorrect or incomplete personal data about you, you can always request that we correct or supplement this personal data.
The right to erasure and restriction: In some cases, you may request that we delete your personal data or that we limit our processing for a certain period of time. Please note that limiting or deleting your personal data may result in e.g. us not being able to provide you with the products you have purchased.
The right to object: You have the right to object to the processing we perform based on our legitimate interest.
The right to data portability: In cases where we base our processing on your consent or on the fulfilment of an agreement, you also have the right to receive your personal data in a structured, commonly-used and machine-readable format and have the personal data transferred to another controller.
Withdrawal of consent: If you have given your consent to processing of your personal data, you always have the opportunity to withdraw your consent by contacting us using the contact information below.
If you have any questions about our processing of your personal data, you can contact us by e-mail at victor.ask@heidelbergmaterials.com or by sending a letter to Marieviksgatan 25, Box 47055, 117 43 Stockholm, in an envelope marked ”Att: Chief Privacy Officer”. If you have any objections or complaints regarding how we process your personal data, you also have the right to contact or file a complaint with the Swedish or Norwegian Data Protection Authority.
6. Cookies
When you visit our website, we may collect and/or store information about your visit to manage and improve this website, for our internal information gathering and for statistical analysis by placing cookies. Cookies are small text files that a website or its service provider transfer to your computer’s hard drive through your browser. Cookies enable us to recognize your browser and to access and store certain information.
For further information on how we use cookies on our website, please read our Cookie policy.
7. Changes
If any changes are made concerning the processing of your personal data, we will inform you of the changes by publishing an updated version of this privacy notice on HC’s website www.hc-ne.com.
Information about the processing of your personal data in connection with our events
Introduction
For us at Heidelberg Materials ('Heidelberg Materials' or 'we'), it is important that you have a good experience when you visit events or other kinds of business-related activities that we organise (jointly referred to as 'events'). We may therefore collect your personal data prior to or during such events.
It is also important for us to be able to explain what we are doing within the framework of our business activities in an interesting, real-life way. This is why we sometimes take group photos and videos during events we organise. Such group photos and videos may be published, for instance, in our newsletters and magazines, but also on our social media and in other communication channels.
The purpose of this information sheet is to help you understand how we process your personal data when you visit and take part in events that we organize.
We respect your privacy and protect the personal data we process about you. All processing of personal data takes place in accordance with the European Union’s General Data Protection Regulation (GDPR). Below is a description of how we collect, process and share your personal data.
Which personal data will be processed and for what purposes?
a) We may process your name, your professional role, the name of your employer, your contact details (email address, phone number and address) and any dietary requirements in order to invite you to an event and make sure that you have a good experience when you visit or participate in an event.
b) We may process group photos and videos from events that include you. Group photos and videos are photos and videos in which no particular individual is in focus, but which give a general view of an event, such as a photo or video of the audience during a lecture. We process your personal data, i.e. group photos and videos in which you appear, in order to document our events and to provide information about what is happening within the framework of our business through publication in our various information channels (printed and electronic material, websites and social media).
What is the legal basis for the processing of your personal data?
The processing of your personal data for the purposes described in (a) above is based on our legitimate interest in being able to invite relevant persons to our events, and to ensure that the people who visit or participate in events have a good experience.
The personal data we process is generally personal data associated with your professional role, and it is our assessment that this data can generally be considered to be of a less sensitive nature with regard to privacy.
We also give you the opportunity to inform us of whether you have any special dietary requirements, if we are providing food and beverages during an event. This is only for your convenience, and if you choose not to notify us of any preferences, you will be served whatever is offered to the other participants.
Information about any dietary requirements is only used to enable us to offer alternatives to what is served to other participants, as far as possible, and not for any other purpose.
On the basis of the above, we have undertaken a balancing of interests with the result that we assess that our legitimate interest in being able to invite you to events and make sure that you have a good experience outweighs your interest in your personal data not being processed for these purposes. If you disagree with our assessment, you always have the right to object. You can read more about your rights below.
The processing of your personal data for the purposes described in (b) above is based on our legitimate interest in being able to document our events and provide information about our activities.
Publication of e.g. group photos and videos from our events is important in order to convey a real-life view of our business and to be able to create interesting information material.
The use of group photos and videos from company-related events is common in the world of business, and our perception is that it is generally both appreciated and accepted.
On the basis of the above, we have undertaken a balancing of interests with the result that we assess that our legitimate interest in using group photos and videos in which you appear in order to provide information about our business outweighs your interest in your personal data not being processed for these purposes. If you disagree with our assessment, you always have the right to object. You can read more about your rights below.
Who has access to your personal data?
We have implemented appropriate technical and organisational security measures in order to protect your personal data and to process it responsibly. The number of people who have access to your personal data is limited. Only persons in our organisation who need to process your personal data in accordance with the purposes stated above have access to the personal data. Please note, however, that group photos and videos in which you appear may be made available to a larger, indeterminate group of people outside Heidelberg Materials when we publish material in our information channels, as mentioned above.
We may share your personal data with companies within the Heidelberg Materials Group in order to achieve the purposes described above.
We may also share your personal data with suppliers and partners who perform services for our account or who otherwise collaborate with us, such as PR agencies, event coordinators, printing firms and IT system providers. These parties are primarily established within the EU/EEA. There may, however, be transfers to countries outside the EU/EEA, see below.
Your personal data may be shared in countries outside the EU/EEA where companies within the Heidelberg Materials Group or our suppliers and business partners are established. Such countries may have a lower level of protection for personal data than is provided within the EU/EEA.
When your personal data is shared in countries outside the EU/EEA, we use standard contractual clauses approved by the European Commission to ensure an adequate level of protection of your personal data. The standard contractual clauses are available via the following link: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-…. In relation to US suppliers and business partners, we may also rely on Privacy Shield certification in some cases. Information about Privacy Shield is available via the following link: https://www.privacyshield.gov/welcome.
How long do we store your personal data?
Your personal data will only be stored for as long as is necessary based on the purposes for which it was collected. This means that your personal data will be stored for as long as we consider it relevant to invite you to our events.
We conduct an annual review of our register of relevant individuals and purge those persons (and their respective personal data) whom it is no longer relevant to invite to events, and purge the personal data that is no longer necessary in order to send invitations to the persons in question. Information about any dietary requirements is deleted as soon as an event has been completed.
Group images and videos from our events are saved for three years. Please note, however, that we will not be able to delete personal data that can be found in printed material and material that has already been distributed.
What are your rights?
The Heidelberg Materials company that collects your personal data is the data controller for the processing of your personal data. This is generally the company that is the organiser of an event. This means that the company is responsible for ensuring that your personal data is processed correctly and in accordance with applicable legislation.
You have the right to know which personal data about you we process and you can request a copy of the personal data that is processed. You have the right to request rectification of inaccurate or incomplete personal data, and in some cases you can request that we erase your personal data. You also have the right to object to the processing of your personal data and to request that the processing of your personal data be restricted. Please note, however, that we are not always able to adjust or erase printed material and material that has been published or distributed.
If you have any questions about how we process your personal data or if you wish to exercise your rights, you are welcome to contact the Heidelberg Materials company that is the data controller. Contact details for all companies can be found on each company’s website. Regardless of which Heidelberg Materials company is the data controller, you can always contact:
Heidelberg Materials Sverige AB, company reg. no. 556000-6057, at Box 47055, SE-100 74 Stockholm;
Heidelberg Materials central communications department by email at asa.lager@heidelbergcement.com,+46 (0)8-58 79 69 26; or
If you have any objections or complaints about how we process your personal data, you have the right to contact or lodge a complaint with the Swedish Authority for Privacy Protection.
Changes
If any changes are made regarding the processing of your personal data, we will inform you by publishing updated information on our websites.
The purpose of this privacy notice is to provide information on how Heidelberg Materials Sweden AB, org. nr 556000-6057 together with Heidelberg Materials Ballast Sverige AB, org. nr 556016-1183, Heidelberg Materials Betong Sverige AB, org. nr 556188-3892 and Heidelberg Materials Cement Sverige AB, org. nr 556013-5864 (together ”HM” or ”we”), as joint controllers processes your personal data in connection with the use of E-Mail Protection System (”EMPS”). The joint responsibility for the processing of personal data is based on our collaboration relating to the implementation and use of EMPS as a tool for reviewing certain e-mails for the purposes listed below.
We respect your privacy and duly protect the personal data we process about you. All processing of personal data is carried out in accordance with the European Union’s General Data Protection Regulation (the “GDPR”). The following describes how we collect, process and share your personal data.
2. How does EMPS work?
EMPS is a system within HM which monitors emails sent to or from carefully selected employees whose professional role may present increased risks from a competition law perspective (”Affected Employees”). The Affected Employees are employees who work within HM’s management and employees who work within the marketing and sales departments. Through EMPS, a filter is installed in the email software Microsoft Outlook which scans the incoming and outgoing emails with the exception of emails that have been marked as private and emails to and from certain sensitive senders and recipients such as employee representatives, data protection officers, legal counsel, certain HR representatives and employees within Legal and Compliance Northern Europe. If necessary, Mannheimer Swartling Adovokatbyrå may be asked to provide assistance with the review.
If an email contains a pre-defined keyword or a certain domain name (and is not exempt from EMPS) the email will be copied and sent to certain dedicated inboxes. The email will subsequently be reviewed by the group-wide function Legal and Compliance Northern Europe, in order to determine if the email contains improper wording or correspondence that suggests a lack of awareness of what is allowed pursuant to HM’s internal policies, regulatory documents and/or competition law.
3. What personal data do we process about you?
We collect personal data directly from you or from other parties that enter your personal data in email correspondence. The personal data that will be processed through EMPS is mainly personal data that frequently appear in work-related email correspondence, such as name, address, phone number, title, place of employment and other information included by the sender.
Emails may be viewed as blank text fields where the sender may choose to include personal data that normally does not appear in work-related email correspondence. Therefore, we are unable to provide an exhaustive enumeration of the categories of personal data that may be processed by HM through EMPS.
4. For what purpose is the personal data processed?
The described processing activities will enable HM to identify potential deficiencies in Affected Employees’ knowledge of what is allowed according to competition law, and identify potential breaches of competition law at an early stage. This gives HM the opportunity to take appropriate actions to prevent future breaches by improving our employee’s knowledge through specialized training efforts as well as rectifying potential breaches of competition law. The processing carried out via EMPS also benefits many of the data subjects in that, as a result of the e-mail review, they are less likely to commit breaches of competition law which decreases the risk for being subject to extensive internal- or authority investigations.
5. What are the legal grounds for processing of personal data?
The processing is based on HM’s legitimate interest in increasing the internal knowledge level relating to, and to prevent breaches of, competition law. HM has carried out and documented a balancing test, where we have weighed our interest in performing the processing activities against the data subjects’ interest in not having their personal data processed.
We consider that our interest in performing the processing activities outweighs the interests of the data subjects’ in not having their personal data processed. Please contact us using the contact information provided in Section 8 below if you would like access the complete balancing test performed to reach this conclusion.
6. How long is the personal data stored?
All emails sent or received by an Affected Employee, with the exception of private or otherwise excluded e-mails) will be scanned through EMPS. Only emails containing any of the predefined keywords or domain names will be copied and sent to certain dedicated inboxes for review. Emails that do not contain any of the keywords or domain names will be deleted without further review.
Emails that are sent for review but which do not indicate a lack of understanding of what is allowed according to internal rules and/or competition law will be deleted from the inbox directly after review.
Emails that are sent for review which indicate a lack of understanding of what is allowed according to internal rules and/or competition law will be printed and then deleted from the inbox in EMPS. The printout will be saved for as long as the indication concerning the lack of understanding of rules remains and during the following review. It will then be destroyed.
Emails that are sent for review but are not reviewed within 14 days will be automatically deleted from the inbox in EMPS.
In addition to the personal data processing carried out through EMPS, HM are continuously creating backup copies of our entire IT system, which includes all emails that have been sent or received by HM employees. These backup copies are downloaded to a magnetic tape where they are stored for 10 years. The backup copies are saved in order for us to be able to restore the entire IT system after unlawful access, extensive hardware failure or accidents (such as fire or flooding).
7. Who has access to your personal data?
We have implemented appropriate technical and organisational measures to protect your personal data against loss, accidental and unlawful access and unauthorised disclosure. The number of persons with access to your personal data is limited. Only a few individuals within Legal Compliance Northern Europe will be given access to the emails that have been scanned by EMPS and sent for further review. However, if necessary, Mannheimer Swartling Adovokatbyrå may be asked to provide assistance with the review. Furthermore, the IT department may be given access to the personal data. The IT department will not process the personal data on a regular basis, but only to the extent required for potential support and service.
We will be sharing your personal data with the two companies within the Heidelberg Materials group listed below:
Heidelberg Materials AG as system owner of EMPS and data processor for the personal data processing described above, and
Global IT Center s.o.r. as sub-processor to Heidelberg Materials AG for the personal data processing described above.
We may also share your personal data with suppliers and partners that carry out services on our behalf or in other ways collaborate with us to ensure IT functionality, such as Microsoft who provides the software program Outlook.
8. What are your rights?
Heidelberg Materials Sweden AB, Heidelberg Materials Ballast Sverige AB, Heidelberg Materials Betong Sverige AB, and Heidelberg Materials Cement Sverige AB are joint data controller for the processing of your data. This means that we are jointly responsible for your personal data being processed correctly and in accordance with applicable laws. Read more about your rights below.
Right to access: You are entitled to know what personal data we are processing about you, for which purposes we are processing the personal data and who we share your personal data with, etc. You also have the right to gain access to the personal data and request a copy of such data.
Right to rectification: If you notice that we have incorrect or incomplete personal data about you, you can always request that we correct or complete such personal data.
Right to erasure and restriction: In some cases, you may request that we delete your personal data or that we restrict our processing for a certain period of time. Please note that deletion or restriction of your personal data may result in us not being able to fulfil our obligations under our employment agreement or receive emails from you.
Right to object: In certain cases, you have the right to object to the processing, for example you may object to the processing that we perform based on our legitimate interest.
Right to data portability: In cases when we base our processing on your consent or the fulfilment of an agreement with you, you are entitled to extract your personal data in a structured, commonly used and machine-readable format and to transfer the personal data to another controller.
If you have questions regarding how we process your personal data, you are most welcome to contact Heidelberg Materials Sweden AB who has been chosen as the common point of contact concerning the personal data processing that we jointly perform through EMPS by sending an email to victor.ask@heidelbergmaterials.com or by mail to Marieviksgatan 25, Box 47055, 100 74 Stockholm, Sweden.
If you have any objections or complaints about the way we process your personal data, you have the right to file a complaint with the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten).
9. Changes
If any changes are made concerning the processing of your personal data, we will inform you of such changes by publishing an updated version of this privacy notice on this website. If you are employed by us, you will also be able to access the updated version of this information text on our intranet.
