隱私政策

英語 This document is the implementation of the administrator's information policy towards users of the www.brunnback.com domain (website) in all aspects of processing and protection of personal data. Personal data may be processed when you browse the website or when you contact the administrator. We attach great importance to the protection, collection, processing and use of your personal data in accordance with applicable regulations.

1. Information about personal data controller and collection of personal data. From which sources do we obtain personal data?

1.1. Personal data controller for the processing of personal data in accordance with art. 4 (7) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free flow of such data and on the repeal of Directive 95/46/EC (general data protection regulation) concerning the protection of personal data is Brunnbäck Sweden Natural Mineral Water AB with registered office in Granåsvägen 51, 77550 Krylbo, Sweden, entered in the Swedish Companies Registration Office's register under Organization number 559365-3693, telephone +0046731592359, e-mail: info@brunnback.com (hereinafter the data controller ).

1.2. The personal data controller processes personal data and contact information that you have provided on the website such as data collected through cookies and website navigation data.

Personal details and contact details. The data controller processes personal data that you have provided to us and that is necessary for the website to function properly, contact through the website's tools, including the contact form, for other communications and contact, including questions regarding the submission and acceptance of offers, sending commercial information, conclusion and execution of the agreement entered into via the website, i.e. agreements for electronic services, conclusion and implementation of other agreements, accounting and financial reporting, correction, as well as for marketing and statistical purposes. For these purposes, the data controller collects your personal data such as: first and last name, e-mail address, telephone number and possibly address, company name, tax identification number, organization number REGON and other information provided in connection with the contact, especially in the contact form. When entering into an agreement, it is necessary to provide personal data in order to perform the agreement. If the processing of data is voluntary, the information will be processed on the basis of consent, which will depend on the content of the given consent.

The personal data controller processes personal data that you have provided to us in the contact form in order to perform the service provided electronically - the Contact Form. For this purpose, the data controller collects your personal data such as: first name, e-mail address, telephone number. Entering an e-mail address is necessary for us to respond by e-mail to the question sent via the contact form. In case of your request for telephone contact, it is also necessary to provide a telephone number. Processing takes place in accordance with Art. 6 (1) lit. b EU regulation.

Cookies. Personal data controllers also use the information collected through cookies for analytical and other purposes described in the cookie policy. They provide data about user activity on the website. The use of cookies is based on your consent. You can turn off cookies at any time by changing

the settings in your browser. The information in cookies is processed according to the conditions specified in the Cookies Policy.

Navigation data. IT systems and software procedures used for the operation of this website acquire during their normal operation certain personal data, the transmission of which is implicit in the use of Internet communication protocols. This category of data includes the IP addresses or domain names of the computers used by users connecting to the website, the addresses in the Uniform Resource Identifier (URI) notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the received file, the numerical code indicating the status of the response given by the server (success, error, etc.) and other parameters related to the user's operating system and computer environment. These data are used only to obtain anonymous statistical data on the use of the website and to check its correct functioning.

Google Analytics. The website also uses Google Analytics to analyze website traffic, collect and analyze data about the behavior of website visitors. Web traffic analysis is primarily used to optimize a website. In accordance with certain functions of Google Analytics, "cookies" can be used for marketing purposes and the information in them can be profiled.

The operator of Google Analytics is Google Inc., 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351 with registered office in the USA.

The user can at any time refuse consent to the collection of data related to the use of the website by Google Analytics, and to the processing of this information in connection with this by Google, and can at any time prevent such activities. To do this, download the browser extension available here: tools.google.com/dlpage/gaoptout and then install it.

1.3. Personal data is processed according to:

a) Art. 6 (1) lit. b EU Regulation – within personal data that is necessary to fulfill an agreement or to take measures at your request before such an agreement is entered into, e.g. to contact you before such an agreement is entered into, answer questions, send each other a message also via the contact form, instant messages, etc.

b) Art. 6 (1) lit. c EU regulation - within personal data whose processing is necessary to fulfill a legal obligation incumbent on the person in charge of personal data, e.g. for invoicing such as financial accounting and reporting

c) Art. 6 (1) lit. f EU regulation - within personal data whose processing is necessary for purposes relating to the interests of the person in charge of personal data, i.e. for the submission of commercial messages such as for direct marketing or for the exercise of legal claims

d) Art. 6 (1) lit. a EU regulation - if you have given your consent for your personal data to be processed if the processing of the personal data is optional.

1.4. In relation to your personal data, the data controller does not make any automated decisions that are the result of automatic processing, including profiling in accordance with the regulation. The data may be profiled according to functions in Google Analytics.

1.5. The data controller stores your personal data for the time absolutely necessary to perform the contract, including the exercise of legal claims such as compliance with the requirements arising from applicable regulations, including tax regulations, as well as for the time required for other purposes

2. Individual rights

2.1. You have the right to receive confirmation from the personal data controller if he processes your personal data, the right to request access to this data and the right to receive information from the personal data controller about the purpose of the processing and the categories of personal data that are processed, information about recipients or categories of recipients to whom personal data is disclosed , the planned period of storage of personal data, information about where the personal data comes from when it was not collected from the person to whom it relates, and information about the personal data controller making automated decisions against that user, including automated decisions based on profiling. You also have the right to receive a copy of the data.

2.2. You also have the right to request from the personal data controller correction or deletion of the personal data or restriction of processing of personal data, right to portability of personal data or to object to such processing. You can exercise your powers:

2.2.1. in the case of rectification of personal data: if your personal data is incorrect or incomplete;

2.2.2. in the case of erasure of personal data: if your personal data is no longer necessary for the purposes for which it was collected by the data controller; you withdraw that consent to the processing; you object to the processing; your personal data has been processed in an illegal manner; the personal data must be deleted in order to fulfill a legal obligation in law or they have been collected in connection with the offer of information society services;

2.2.3. with regard to the right to restriction of processing: if your personal data is inaccurate, you may have the right to demand from the personal data controller that the processing is limited for a period of time that gives the personal data controller the opportunity to check whether the personal data is correct; the processing is illegal and you object to the deletion of the personal data; the personal data controller no longer needs the personal data for the purposes of the processing but the data subject needs them to be able to establish, assert or defend legal claims; or if you have objected to processing pending verification of whether the data controller's legitimate reason outweighs your legitimate reason;

2.2.4. with regard to the right to portability of personal data: if the processing is based on your consent or agreement such as if the processing is automated;

2.2.5. regarding the right to object: if the processing of your personal data takes place on the basis of legitimate interests and the objection relates to your specific situation, such as if your personal data is processed for direct marketing and is profiled.

2.3. You also have the right to submit a complaint to a supervisory authority, if you believe that the processing of personal data concerning you is contrary to this regulation. In Sweden, he is the director of the Swedish Agency for Personal Data Protection.

2.4. Security procedures in place mean we may ask you to confirm your identity before we extend your rights.

3. Consent to the processing of personal data

3.1. If the processing of data is voluntary, e.g. if the data controller processes personal data that is not necessary to perform the service or the contract, submission of the data is always voluntary, when you have given your consent to the processing of personal data.

3.2. Consent occurs when you have read this privacy policy. In such a case, you consent to the personal data controller collecting and processing the data you have provided for a purpose clearly stated, when you have given your consent, for example by ticking an appropriate box.

3.3. You have the right to withdraw your consent at any time in the same way as it was given.

3.4. In addition, you can withdraw your consent by sending an explanation of the withdrawal of consent in a manner described in point 6 of the Privacy Policy.

3.5. The fact that you revoke consent does not affect the legality of the processing before it is revoked.

4. The recipients / categories of recipients

4.1. Personal data controllers may also partially use external service providers who process personal data on behalf of the personal data controller, e.g. hosting service providers, e-mail service providers, accounting service providers, payment service providers, condition service providers, debt collection service providers, marketing service providers. However, the transfer of data may only be used to provide their service. Personal data controllers only use services from entities that provide sufficient guarantees to protect the rights of those concerned. If those units are not independent personal data controllers, processing of personal data by these units takes place on the basis of written agreements entered into with the personal data controller. These entities follow the guidelines of the data controller and are subject to audits carried out by him. Your data that you submit on the website, especially image, is also available to website users.

4.2. Your data may be provided to entities that are subordinate to the data controller for strictly related and necessary purposes for the provision of services, for example management of IT systems or for the processing of activities carried out by other branches of the group for the same purposes.

4.3. Personal data submitted by the user who orders the delivery of information materials (brochures and other information materials, etc.) will only be used to organize the delivery and will be disclosed to third parties (postal companies, labeling companies, courier companies, etc.) only if it is necessary to reach it.

4.4. In connection with personal data controllers using certain services, e.g. Gmail, Google Analytics, Google Drive, G-suite, data may be transferred outside the EEA, but only if there is a guarantee to ensure a sufficient level of protection, e.g. the entity's participation in the Privacy Shield program established by Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 on whether adequate protection is ensured by the Privacy Shield in the EU and the United States.

4.5. The data controller also has a fan page on Facebook and Instagram. In connection with this, data such as first and last name or other data depending on the functions of these websites may be collected and made available to Facebook's or Instagram's operator. In this case, personal data is processed to use the administrator's web pages on these websites and marketing using these websites.

4.6. The website contains links to other websites. Their presence may involve the collection of data by and for pages managed by third parties. The handling of information collected by "third parties" is also subject to appropriate regulation in accordance with the rules applied by the relevant separate data controller.

4.7. Apart from the circumstances mentioned above, the information will not be disclosed to anyone, except in situations resulting from requirements in the agreement or with the consent of the person concerned.

In these cases, personal data may only be disclosed to third parties only under the condition that:

- you have expressly given your consent to the transfer of your personal data to third parties;

- it is necessary to transfer personal data to third parties in order to perform the ordered service or contract;

– at the request of a competent authority.

In no other cases will the information be disseminated.

5.1. The personal data controller processes your personal data in accordance with the provisions of the regulation, it uses appropriate technical and organizational measures to ensure security and appropriate confidentiality and integrity of personal data, including protection against unauthorized access, unauthorized modification, disclosure or destruction of this data.

6. Contact details

6.1. If you have a request or questions about how we process personal data, you are always welcome to contact us by e-mail: info@brunnback.com or write to us at: Brunnbäck Sweden Natural Mineral Water AB with seat in Krylbo under street address Granåsvägen 51, 77550 Krylbo, Sweden.

This Privacy Policy was last modified on 20240110.