PRIVACY POLICY – PATRIKSSON GROUP

INTRODUCTION

Patriksson Group works to ensure that your privacy is protected when using our services. We therefore have a policy setting out how your personal data will be processed and protected. Please stay updated to any changes to this Privacy Policy by visiting our website.

This Privacy Policy only concerns users of Patriksson Group’s marketing, media, influencer, VIP and online services (media bank, events rsvp system, showroom database and contact database) and any individuals that provide Patriksson Group or any of its employee with personal information for the fulfillment of for example press, marketing, event, communication, influencer, gifting and promotional services.

WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

The Swedish company, Patriksson Group AB (reg.no. 559041-1665) is together with each national Patriksson Group company (listed below) respectively joint controllers of the personal data you submit to each respective Patriksson Group company when using Patriksson Group’s marketing, media, influencer, VIP and online services and when you provide the respective Patriksson Group company or its employees with personal data for the fulfillment of our services (such as press, marketing, event, communication, influencer, gifting and promotional services) and, thus, Patriksson Group AB and each Patriksson Group company are jointly responsible for your personal data (below together referred to as "Patriksson", "we", "us"). For example: if you have provided your personal data to the Swedish Patriksson company for the use of Patriksson Group’s media bank, the Group's events "rsvp" system or to be a part of the showroom database and contact database, the Swedish Patriksson company (i.e. Patriksson Communication AB) and Patriksson Group AB will be joint controllers for the processing of your personal data.

Each of the companies listed below are responsible for the fulfillment of the legal obligations of a controller in relation to your rights as a data subject under applicable data privacy laws. Thus, should you wish to use any of your rights with regard to the personal data in scope of this Privacy Policy, you should contact the relevant national Patriksson Group company. Please see further details of your rights and how to use them below.

Sweden: Patriksson Communication AB (reg. no. 556592-7646)

Denmark: Patriksson Communication Aps (reg. no. 38291513)

Norway: Patriksson Communication AS (reg. no. 918347933)

France: Patriksson Communication Paris with the legal company name Relative Mo Ltd (reg.no.: RCS Paris 514 473 172)

WHAT TYPES OF PERSONAL DATA DO WE COLLECT?

We will collect personal data that you submit to us when interacting with our media bank, rsvp system, showroom database and contacts database or through e-mail or phone with any of our employees. The personal data that you submit to us may for example include name, job title, company name, company address and phone number, home address and door code, home phone number and mobile phone number, photo, social media account information, email addresses, date of birth, allergies, clothing and/or shoe sizes and beauty references. In addition, we may use service providers providing information updates (for address and telephone data) in order to make sure that the information provided by you is kept up to date.

HOW DO WE USE YOUR PERSONAL DATA?

We may use your personal data for the following purposes and based on the following legal basis:

FOR HOW LONG DO WE KEEP YOUR PERSONAL DATA?

We will keep your data for as long as you have an account to use our media bank service and for three (3) months after you end your account in order to provide reports of your use of our media bank service or if you are registered in our rsvp system, showroom database or contact database and are taking part of our services connected thereto for as long as you have an active relationship with us, however, no longer than two (2) years from your last communication with Patriksson or for as long as we are required in order to comply with requirements in applicable law. After this your personal data will be deleted.

WHAT ARE YOUR RIGHTS?

You have the right to, at any time, receive a copy of the personal data that we hold about you and information about the processing. Please note that Patriksson needs to, in order to be able to answer your request, be able to determine your identity.

You have the right to, without undue delay, have incorrect, incomplete or irrelevant personal data about you corrected.

You have the right to have your personal data deleted without undue delay and Patriksson is obliged to delete your personal data without undue delay if, for example one of the following grounds applies: the personal data are no longer necessary in relation to the purpose for which they were collected or otherwise processed, or if you withdraw consent on which the processing is based and where there is no other legal ground for the processing. Please note that we are not obliged to delete the personal data if we can show that the processing is necessary, for example, for compliance with a legal obligation to which Patriksson is subject, such as book-keeping rules or the establishment, exercise or defence of a legal claim, or when there are other legitimate grounds to keep the data, such as unreturned samples loans.

Furthermore, you have the right to request that Patriksson restricts the processing of your personal data under certain conditions, for example if you contest the accuracy of the personal data, the processing may be restricted for a period enabling Patriksson to verify the accuracy of the personal data or if Patriksson no longer needs the personal data for the purposes of the processing but you require the personal data for the establishment, exercise or defence of legal claims.

You have the right to object, on grounds relating to your particular situation, at any time to Patriksson's processing of your personal data if the processing is based on, for example, legitimate interests, including marketing and/or profiling based on a legitimate interest. If you object to such processing, Patriksson will no longer be entitled to process your personal data based on such legal basis, unless Patriksson can demonstrate compelling legitimate grounds for the processing which overrides your interests, rights and freedom or if it is conducted for the establishment, exercise or defense of a legal claim.

You have, under certain conditions, the right to receive the personal data concerning you and which you have provided to Patriksson, in a structured, commonly used and machine-readable format and have the right to transmit such personal data to another data controller without Patriksson trying to prevent this, where Patriksson's processing of your personal data is based on your consent or on a contract and the processing is carried out by automated means. You have in such case the right to request that the personal data from Patriksson shall be transmitted directly to another data controller, where technically feasible.

You also have the right to, at any time, withdraw your consent given to Patriksson for the processing of your personal data e.g. for marketing purposes. If you withdraw your consent, please note that this does not affect the lawfulness of the processing based on your consent before its withdrawal and that Patriksson may, under certain circumstances, have another legal ground for the processing and therefore may be entitled to continue the processing.

If you are unhappy with our processing of your personal data and/or consider it to be in contrary to applicable legislation you may lodge a complaint with a competent supervisory data protection authority (“DPA”) (such as with the DPA in your country of residence, the DPA in the country of your place of work or the DPA in the country where the alleged infringement has occurred).

If you wish to receive a copy of the personal data we process about you, or if you want to exercise any of the above mentioned rights, please contact us either by sending a letter to or by sending an email to the relevant national Patriksson Group company by using the contact details provided in the end of this Privacy Policy.

WHO HAS ACCESS TO YOUR PERSONAL DATA?

Your data may be shared within Patriksson Group and its affiliated companies (for details on the companies within the Patriksson Group, please see www.patrikssongroup.com).

We may further transfer your data to third parties outside the Patriksson Group such as our clients, shipping agents and website and database mangers etc. The data that is forwarded to third parties, is only used to fulfill and provide you with the services mentioned above, for example in the processing of a gift send outs, loan handling, promotion send outs, guest list planning, invitation send outs for events etc.

The data may further be disclosed to service providers and subcontractors retained to perform functions on our behalf or to provide services to us, such as hosting providers, infrastructure providers. All service providers and subcontractors are prohibited from using personal data for purposes other than providing such services to us or as otherwise required by law. We aim to choose the option for data processing services that best safeguards the integrity of your personal data towards any third party. The service providers may be located within or outside the EU/EEA, please see below section "International transfers of your personal data" for information on how we protect your personal data when it is transferred outside the EU/EEA.

Your personal data may also be disclosed to authorities in order to (i) prevent, detect, investigate and take measures against criminal activity, fraud and misuse of or damage to our services; (ii) take measures against other threats against Patriksson's or a third party's rights; (iii) comply with applicable laws, regulations, court orders, government and law enforcement agencies’ requests.

INTERNATIONAL TRANSFERS OF YOUR PERSONAL DATA

The data that we collect from you is stored within the European Union (“EU”) and the European Economic Area (“EEA”), but may be transferred to and processed in a country outside of the EU/EEA (i.e. a so-called third country), including countries which the EU Commission does not consider having an adequate level of protection for personal data. In such case we will take all necessary steps required under applicable law in order for such transfer of information across borders to be compliant with applicable law. Patriksson will only transfer your personal data to a country outside the EU/EEA where; (i) the EU Commission has decided that the third country ensures an adequate level of protection, or (ii) where the transfer is being safeguarded by the use of EU model clauses (under Article 46.2 in the General Data Protection Regulation (2016/679) ("GDPR")) or where the recipient is certified under the US-EU Privacy Shield Framework (under Article 45 in the GDPR). Patriksson may transfer your personal data to the United States of America through the EU Model clauses. To take part of the mechanisms used, please click here:

https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/modelcontracts-transfer-personal-data-third-countries_en.

HOW DO WE PROTECT YOUR PERSONAL DATA?

We have taken technical and organisational measures to protect your data from loss, manipulation, unauthorised access. We continually adapt our security measures in line with technological progress and developments. However, no data transmission over the internet can be guaranteed to be 100% secure and whilst we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us and you do so at your own risk.

CONTACT INFORMATION:

Last updated: 30/09/2019