1. Introduction
Gruvaktiebolaget Viscaria (publ), Reg. No. 556704-4168 (“Viscaria,” “we,” “our,” or “us”), collects and processes personal data about you if you:
- visit our website;
- contact Viscaria to subscribe to information from Viscaria, such as press releases, job vacancy notifications through our career portal, to receive stock price information, or to order printed information via our website or otherwise;
- communicate with us, for example, through forms on our website or via email; and
- come into contact with Viscaria in your work or assignment with any of our customers, suppliers, or collaborators.
- This privacy policy describes what personal data Viscaria, in its capacity as the data controller, collects about you and for what purposes the personal data is processed.
In this privacy policy, the term “processing” is used for all activities involving your personal data, including, for example, collection, management, storage, sharing, access, use, transfer, and deletion of personal data.
The term “applicable data protection legislation” refers to all legislation and regulation, including such regulation issued by the supervisory authority responsible for protecting individuals’ fundamental rights and freedoms, particularly their right to privacy regarding the processing of their personal data. This includes the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (“GDPR”), as well as laws and regulations that complement the GDPR.
The term “personal data” refers to any information relating to an identified or identifiable natural person.
2. Who is the Data Controller?
Gruvaktiebolaget Viscaria (publ), Reg. No. 556704-4168, Viscariavägen 10, SE-98199 Kiruna, Sweden is the data controller for the processing of your personal data as outlined in this privacy policy.
3. Where do we collect your personal data?
We collect your personal data from:
- Yourself, when you provide information to us or when we collect it from you, for example, when you visit our website.
- Other sources, which may include information from publicly available sources and from our suppliers, with the purpose of (i) confirming information you have provided to us, (ii) updating information we have about you, or (iii) obtaining information about you.
You can always choose not to provide voluntary information to us. However, some personal data is necessary for us to provide you with certain services or to have business dealings with your employer. If you do not provide such personal data, it may prevent us from providing you with certain services or performing in accordance with your expectations.
4. Why do we process your personal data?
4.1 Evaluate and Improve Your Experience on Our Website
We collect and store IP addresses, location data, browser type, operating system, and other information about your use of our website, including the history of the pages you visit. We do this to adapt to the needs of our visitors. We may also use your IP address to diagnose problems with our server, administer our website, analyze trends, track visitor activity, and collect broad demographic information that helps us identify our visitors’ preferences.
For statistical purposes, we store information about the number of individual users on our website and how often these individual users visit our website. We collect and store this information to better understand the needs and interests of our visitors so that we can develop and improve the website in the future. For more information about our use of cookies, please read our section on section 5 below.
| Categories of Personal Data | Legal Basis |
| IP address IT equipment data Log data User-generated data |
Consent. We collect information through the use of cookies based on your consent. For more information about our use of cookies, read section 5 below. |
| Exception for Special Categories of Personal Data | |
| N/A | |
| Storage Period | |
| Your personal data is stored for as long as necessary, but no longer than 2 years. The storage period for each individual cookie is specified in more detail in section 5 below. | |
4.2 Manage Your Matters Related to Contacting Us
The information you provide us when you reach out to us (e.g., when you have questions about Viscaria) is stored and processed to manage your matter with us as effectively as possible. We process personal data to respond to your inquiry, address your feedback, or handle your case.
| Categories of Personal Data | Legal Basis |
| Contact details Identity information Your communication |
Legitimate interest. Processing is necessary for us to fulfill our legitimate interest in responding to your questions as efficiently as possible and to offer you the assistance you need. |
| Exception for Special Categories of Personal Data | |
| N/A | |
| Storage Period | |
| Your personal data is stored for one year after your matter with us has been concluded. | |
4.3 Ensure that only authorized individuals are present at Viscaria facilities
We process your name, information about the company you represent, entry and exit times from the premises, and in some cases, contact details and photography. During your visit, entry and exit times and positioning may also be recorded within the area (e.g., if there are different zones). At Viscaria facilities using camera surveillance (indicated by information signs at the respective facility), we may process photos of and/or you may be filmed.
| Categories of Personal Data | Legal basis |
| Name Personal identification number Entry and exit times Contact details Photo Your location |
Legal obligation. Processing is necessary to fulfill our legal obligations under the law on electronic personnel registers. Legal obligation. Processing is necessary to comply with legal obligations related to occupational health and safety, designed to ensure that only individuals with necessary qualifications have access to certain areas in the workplace. Legitimate interest. Processing is necessary for us to fulfill our legitimate interest in knowing who has access to Viscaria facilities. |
| Exception for Special Categories of Personal Data | |
| N/A | |
| Storage Period | |
| Your personal data is stored for three years after your visit to Viscaria facilities. | |
4.4 Fulfill Obligations under Agreements with Your Employer or Client, Administer Contracts, Negotiations, or Other Collaborations, or Manage the Requests of Customers, Suppliers, and Collaborators
We process your name, telephone number, mobile number, email address, address, title, role, and a description of job duties, as well as other personal data that may need to be processed to achieve the purpose described above. For example, in documentation related to agreements that Viscaria has with your employer or client, in email contacts, or through publication on Viscaria’s intranet or in other media with the primary purpose of making this personal information available primarily to Viscaria employees.
| Categories of Personal Data | Legal Basis |
| Name Telephone number Mobile number Email address Address Title Role Description of job duties Other personal data that may need to be processed to achieve the purposes |
Legitimate interest. Processing is necessary for our legitimate interest in fulfilling obligations under agreements, administering contracts, negotiations, or other collaborations, and managing the requests of customers, suppliers, and collaborators. |
| Exception for Special Categories of Personal Data | |
| N/A | |
| Storage Period | |
| Personal data is stored for the period during which we have obligations to your employer or client or obligations to our customers, suppliers, or collaborators. However, the data is not stored for more than two years. | |
4.5 To Provide Information to the Capital Market and the Public About Viscaria, Send Invitations to Viscaria’s Capital Market Days and Other Events, and to Administer and Carry Out Such Events (Including Visits to Viscaria’s Facilities)
In connection with your contacts with Viscaria where you represent investors, potential investors, financial institutions, equity and credit analysts on the “buy-side” and “sell-side,” or in your capacity as a journalist or politician, we may process your personal data.
| Categories of Personal Data | Legal Basis |
| Name Telephone number Mobile number Email address Role and description of job duties Other personal data that may need to be processed to achieve the purposes described above |
Legitimate interest. Processing is necessary for our legitimate interest in providing information about Viscaria, sending invitations to capital market days and other events, and in creating and maintaining relationships with decision-makers. |
| Exception for Special Categories of Personal Data | |
| N/A | |
| Storage Period Your personal data is stored until you inform us that you no longer wish to receive further information from us. | |
4.6 Create and Maintain Relationships with Decision-Makers in Local, Regional, and Central Governing Political Bodies
We may process your personal data to create and maintain relationships with decision-makers in local, regional, and central governing political bodies.
| Categories of Personal Data | Legal Basis |
| Name Telephone number Mobile number Email address Role and description of job duties Other personal data that may need to be processed to achieve the purposes described above |
Legitimate interest. Processing is necessary for our legitimate interest in creating and maintaining relationships with decision-makers in political bodies. |
| Exception for Special Categories of Personal Data | |
| N/A | |
| Storage Period | |
| Personal data is stored during the period the relationship with decision-makers continues. If a decision-maker no longer holds their position, this information will be regularly deleted. | |
4.7 Establish, Exercise, and Defend Legal Claims
We may process your personal data for the purpose of establishing, exercising, and defending our legal claims (e.g., in connection with a dispute or legal process).
We may also process your personal identification number and/or coordination number if we deem it necessary to establish, exercise, and defend our legal claims.
| Categories of Personal Data | Legal Basis |
| Contact details Criminal information Geographic information Identity information (including personal identification number/coordination number) Log data Login information User-generated information Your communication Other data necessary to fulfill the specified purpose |
Legitimate interest. Processing is necessary for our legitimate interest in establishing, exercising, and defending our legal claims, e.g., in connection with a dispute or legal process. |
| Exception for Special Categories of Personal Data | |
| Special categories of personal data, including criminal information, are processed solely to fulfill our legitimate interest in establishing, exercising, or defending our legal claims. | |
| Storage Period | |
| Personal data is stored for the period necessary to establish, exercise, or defend the legal claim. Personal data processed for this purpose is not stored for more than 10 years from the conclusion of the legal process. | |
5. Recipients with whom we share your personal data
5.1 Other data controllers
In cases where necessary, we share your personal data with others. The recipient is the data controller for the processing of your personal data unless otherwise specified by us.
| Authorities | Purpose | Rättslig grund |
| Authorities (e.g., Police Authority and Swedish Tax Agency) Auditors, advisors, legal representatives, and similar representatives | To fulfill potential legal obligations that we are subject to, e.g., in connection with requests from authorities or other legal requests. | Legal obligation. The processing is necessary to fulfill our legal obligations. |
| Authorities (including courts) Auditors, advisors, legal representatives, and similar representatives | To establish, exercise, or defend legal claims. | Legitimate interest. The processing is necessary to fulfill our legitimate interest in managing and defending legal obligations, e.g., in connection with a dispute. |
| Companies within the Viscaria group | To share our IT infrastructure with companies within the Viscaria group. | Legitimate interest. The processing is necessary to fulfill our legitimate interest in sharing our IT infrastructure with companies within the Viscaria group. |
5.2 Service Providers
To fulfill the purposes of processing your personal data, we transfer personal data to external parties, such as service providers we have engaged or the use of shared IT resources within the Viscaria group. These parties provide services in areas including, but not limited to, IT (e.g., data storage) and Support (e.g., support for IT infrastructure). These external parties act as data processors on behalf of Viscaria and may only process your personal data in accordance with our instructions, not for their own purposes. Viscaria is the data controller for the processing of personal data that external parties perform on our behalf.
For research purposes and for statistical purposes, we prepare anonymous, aggregated, or generic data for several purposes, as listed above. Since we believe that you cannot reasonably be identified based on this information, we may share the information with external parties such as our partners, advertisers, industry organizations, media, and/or the public. However, to ensure a high level of security and safety, we adopt a restrictive approach.
5.3 Appropriate safeguards for the transfer of personal data outside the EU/EEA
Viscaria uses providers that involve the transfer of personal data to countries outside the EU/EEA (so-called “third countries”). These transfers are necessary for us to offer our services. Viscaria has entered into data processing agreements with these providers, containing provisions that protect your personal data appropriately in connection with such third-country transfers.
Transfers of personal data outside the EU/EEA are processed in accordance with applicable data protection legislation, including the GDPR. The protection of personal data in connection with transfers outside the EU/EEA is ensured either through (i) the European Commission’s decision on an adequate level of protection, (ii) the legal safeguards provided by the European Commission’s Standard Contractual Clauses (SCC), or (iii) the provider’s adherence to the EU-U.S. Data Privacy Framework. Protection is complemented with technical and organizational security measures, including encryption and anonymization/pseudonymization.
If you have any questions about Viscaria’s transfers of personal data to countries outside the EU/EEA, please contact us using the contact information provided at the end of this privacy policy. You have the right to obtain a copy of all documentation demonstrating that appropriate safeguards have been taken to protect your personal data in a transfer to a third country.
Click here to read more about third-country transfers.
6. Your Rights
According to applicable data protection legislation, you have specific rights regarding the processing of your personal data. We process your personal data to the extent necessary to fulfill your rights. You are welcome to submit requests regarding the exercise of your rights by contacting us using the contact information provided below.
Under certain circumstances, you have the right to exercise the following rights:
| Access | You can request confirmation of whether we process personal data concerning you. If so, you can access the personal data and additional information regarding the processing (e.g., purposes of the processing). You also have the right to receive a copy of the personal data being processed. |
| Objection to Certain Processing | For reasons related to your specific situation, you have the right to object to the processing of your personal data if the processing is based on legitimate interests. In such cases, we will cease processing your personal data based on legitimate interests unless we can demonstrate that our legitimate interests override your privacy interests or that the processing is necessary for managing or defending our legal claims. |
| Rectification | You can request correction of inaccurate personal data concerning you. |
| Deletion | Under certain circumstances, you may have your personal data deleted, e.g., when the personal data is no longer necessary for the purposes for which it was collected. |
| Restriction of processing | Under certain circumstances, you have the right to request that we restrict the processing of your personal data to storage only. This applies, for example, when the processing is unlawful, but you do not want your personal data to be deleted. |
| Withdrawal of Consent | You have the right to withdraw your consent to the processing of your personal data at any time. This applies to the extent that processing is based on your consent. |
| Data portability | You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to request that this data be transferred to another data controller (where possible). |
Click here to read more about your rights in connection with the processing of your personal data.
Give complaints to the supervisory authority
If you have complaints regarding Viscaria’s processing of personal data, you have the right to file a complaint with the relevant supervisory authority. For more information, visit the website of the competent authority. In Sweden, the supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten or IMY). You can learn more about how to file a complaint with IMY here.
7. Contact us
If you have any questions or concerns regarding the processing of your personal data, you are welcome to contact us via email at info@viscaria.com.
8. Changes to this Privacy Policy
This privacy policy may be subject to changes. You will be notified appropriately when changes are made to this privacy policy unless the changes are non-material or insignificant.
This privacy policy was last updated on [2023-11-01].