1. What is GDPR?
Cloetta Norge AS, org.nr. 987 943 033, is the controller and processes personal data in accordance with the following policy and the General Data Protection Regulation (GDPR) and any national rules on data processing (hereafter “Data Protection Rules”)
2. What is personal data?
Personal data is information through which we can directly or indirectly identify you, e.g., name, email address or telephone number.
3. What personal data do we process and what is it used for?
3.1 Participation in competitions and campaigns
We organize and host different forms of competitions and campaigns. We process your personal data to administrate your participation in such competitions and campaigns on the legal basis of agreement. In relation to competitions and campaigns we process personal data such as name, email, address, and phone number. Purchase information (e.g., a receipt) is only processed occasionally and then for purposes of ensuring you are eligible to participant in a competition or campaign. Personal data is erased when the competition or campaign has ended and winners appointed.
We process the information created by cookies when you visit our website. Your personal data, such as behavioral data and device information, is processed on the legal basis of weighing of interests. How long we process your personal data depends on which cookie is placed in your browser. Permanent cookies remain on your computer until you delete them or the expiration date has passed. Session cookies have no expiration date and are temporarily stored in your computer while you are on our website. When you close your browser, any session cookies disappear.
3.3 Rights of data subjects
In order to fulfill the rights you have under the Data Protection Rules and to verify your identity, we need to process your personal data, such as name, email, address phone number and ID information on the legal basis of law. History from your contacts with us when you exercise your rights is erased after a maximum of 24 months.
4. Who do we share the information with?
4.1 Suppliers and other personal data assistants who process personal data on our behalf
We hire different suppliers to provide and develop our products and services. When we use suppliers who process personal data on our behalf, we always sign a data processing agreement with the supplier, who may only process personal data for purposes that we determine and on special instructions from us.
4.2 Transfers to suppliers in third countries
Sometimes we need to transfer your personal data to suppliers who have all or part of their business outside the EU / EEA, so-called “third countries”, in order secure particular services or to ensure that our services are available around the clock. We do not use suppliers in third countries if the country does not have an adequate level of protection or we have taken appropriate protection measures for the transfer in accordance with the requirements set out in the Data Protection Rules.
5. Your rights
5.1 Right to information
5.2 Right of access
You have the right to receive information free of charge about which personal data about you we process (a so-called register extract).
5.3 Right to rectification
We systematically maintain our registers and update your personal data. You have the right to have your personal data corrected if you notice that we have incorrect information or incomplete information about you. We normally correct the personal data without consideration unless we have a reason to object to the change. Any change of the information will be supplied to our suppliers or partners unless it is impossible or requires a large amount of work. If you request it, we will also inform you about which supplier or partners the correction has been issued to.
5.4 Right to erasure
We store your personal data for the duration of the competitions or campaigns, after which the data is erased (or anonymized) within 24 months, except when we are required by law to save the personal data for a longer period.
You have the right to request that we erase personal data if it is no longer needed, you revoke your consent, you object or there are no justifiable reasons for processing that outweigh your interest. When we receive your request, we will make an assessment if there is reason to erase your personal data and notify you of the assessment. Any erasure at your request will be communicated to our suppliers or partners unless it is impossible or requires a large amount of work.
5.5 Right to restriction of processing
You have the right in certain cases to demand that the processing of your personal data is restricted in the sense that personal data will be marked ensuring processing only for certain limited purposes in the future. Restriction can be requested if you have requested rectification, while the accuracy of the personal data is being investigated, the processing is unlawful in part, or while a verification of legitimate grounds is pending.
5.6 Right to object
You have the right to object to the processing of your personal data on the basis of weighing of interests. In that case, you need to specify in writing which treatment you object to. In the event of such objection, we may only continue to carry out the processing if we can show that there are decisive justifiable reasons why the personal data must be processed that outweigh your interests. If your personal data is processed for direct marketing, you always have the right to object to the processing at any time.
5.7 Right to data portability
In some cases, you have the right to obtain and move your personal data. Your request must relate to such personal data that you have provided us and which we process with the support of your consent or to fulfill the agreement with you. The right does not apply when our processing of your personal data is based on weighing of interests or legal obligation.
5.8 Right to withdraw consent
To the extent that we process your personal data on the basis of consent, you always have the right to revoke it whenever you want. The revocation of the consent does not affect the legality of the treatment that took place based on the consent before it was revoked.
5.9 Requests and identification
A request to exercise your rights, except for requests for information, must be made in writing, signed by you and accompanied by a copy of a valid ID document signed by you.
If a register extract is requested, state what information you are interested in. If you send several requests for register extracts, we may charge a fee. The register extract will be sent to you within 30 days of us receiving your request. If the extract is extensive and we need more time or if for some reason we are unable to complete your request, we will notify you.
If you believe that we process your personal data in violation of applicable Data Protection Rules, you should report this to us as soon as possible. You can also contact the Swedish Authority for Privacy Protection.
7. Contact details
Please note that we have not appointed a data protection officer.
Contact us at Cloetta Norge AS, Att: Privacy/Legal, Postboks 263, 1323 Høvik, or firstname.lastname@example.org.