Processing of personal data - supplier contact
Read about the collecting, processing, storage and transfer of personal data of individually identifiable current, past and future supplier Contact persons.
RISE Research Institutes of Sweden AB (RISE), as data controller, processes personal data regarding contact persons of RISE tenderers and suppliers (hereinafter referred to as the “Contact person”), due to the circumstance that the Contact person or its employer or principal has or has had a business relation with RISE, and/or has or has had discussions or negotiations regarding such business relation.
Personal data processed by RISE
The basic personal data of the Contact person that RISE processes may include name, address, phone number, e-mail address, CV and in some cases personal security number (swe: personnummer), and other personal data transferred to RISE from the Contact person or its employer or principal.
From which sources the personal data is collected
In addition to the information transferred to RISE from the Contact person itself, RISE may also collect personal data from the employer or principal of the Contact person.
Purpose and lawful basis
Based on Contract or RISE legitimate interest, RISE processes personal data for the following purposes:
- Analyze and manage received tenders and communication in response to the tender, and award contract to the winning tenderer.
- Manage, administer and fulfill orders. Communication in response to past, current and upcoming orders, or in relation to other issues that may arise as a result of the tender or the contract awarded.
- Implementation, management, administration, follow-up, etc. of the current business relation and its deliveries and associated communication by telephone, e-mail, text message or other communication channels, and the invoicing and payment procedure.
This processing is needed for RISE to be able to fulfill its contractual rights and obligations according to the contract entered or negotiated with RISE. If the contract is entered into or negotiated between RISE and the employer or principal of the Contact person, and the Contact person could reasonably expect the processing which is not deemed to cause unjustified harm, the personal data is processed based on the legitimate interest of RISE, which is to fulfill its contractual rights and obligations towards the contracting employer or principal.
Based on RISE legitimate interest, RISE processes personal data for the following purposes:
- Management, follow-up, evaluations and administration of supplier surveys.
- Marketing of RISE business, projects and various events.
- Comply with applicable laws, e.g. Bokföringslagen (1999:1078).
- Safeguard and exercise legal rights of RISE.
The Contact person would reasonably expect the processing which is not deemed to cause unjustified harm.
To whom the personal data is disclosed
RISE applies appropriate technical and organizational security measures to protect personal data against e.g. loss, misuse and unauthorized access. Only persons within RISE who need to process the personal data in accordance with the above stated purposes will have access to the data.
RISE transfer personal data to third parties acting as personal data processors, e.g. supplier of the supply-, support and maintenance of IT- and cloud services, suppliers of market and supplier surveys, etc.
RISE transfer personal data to third parties within the RISE company group, for the purpose of RISE being able to use the same IT system (e.g. financial system, supplier records, etc.), in order to be able to coordinate its assignment in an efficient manner.
RISE transfer personal data to third parties acting as independent data controllers, e.g. third parties cooperating with RISE within the framework of the overall mission of RISE, insurance companies in the event of insurance matters, authorities if required by applicable law, etc.
Storage and disposal
RISE processes the personal data as long as it is necessary for the purposes for which the personal data was collected.
Personal data processed for contractual and business relation purposes will be processed as long as RISE may have any contractual rights and obligations towards the Contact person or its employer or principal, and as long as necessary in order to comply with any legal obligations.
Transfer to third countries
Personal data processed for contractual and business relation purposes will be processed as long as RISE may have any contractual rights and obligations towards the Contact person or its employer or principal, and as long as necessary in order to comply with any legal obligations. Transfer to third countries.
Legal rights as a contact person
The Contact person has the right to receive information regarding its personal data processed by RISE, and to request for rectification, limitation or deletion of these, by contacting the Data Protection Officer at RISE, at firstname.lastname@example.org. The Contact person also has the right to file a complaint to the Swedish Data Protection Authority.
The personal data processor for the processing is RISE Research Institutes of Sweden AB (company registration number 556464-6874), with mailing address: Box 857 501 15 Borås Sweden.