Data Protection Policy

Eltel AB and its subsidiaries conduct business in Sweden, Finland, Norway, Denmark, Lithuania, Germany and Poland. The relevant Eltel entity that is the contractual counterparty is the data controller for the personal data collected under this policy (hereinafter "Eltel"). Eltel processes personal data that it may receive in its dealings with customers, partners, suppliers, contractors and other relevant third parties for, inter alia, HR related purposes, contractual purposes, information purposes, billing purposes, service improvement and marketing purposes.

Personal data may also be processed for other purposes as described herein. This Data Protection Policy will explain what kind of personal data that is processed, the purposes for which the personal data is used, how the personal data is processed and registered persons' rights in relation to the processing of personal data. All personal data is processed in accordance with this Data Protection Policy and the applicable data protection legislation.

Any questions about how Eltel collects, processes and stores personal data should be directed to local legal Eltel representative in each respective jurisdiction as set out at the end of this policy.

1. Background and purpose

The purpose of this Data Protection Policy is to protect the rights of Eltel´s customers, partners, suppliers, contractors and other relevant third parties with respect to compliance with applicable data protection laws and to provide information on the rights of Eltel, as the data controller.

2. Applicability and scope

The policy is applicable for all entities and all employees within the Eltel Group.

3. Definition of personal data and processing of personal data

The term "personal data" is used to describe any information that may be used to identify, directly or indirectly, a specific individual. Examples of personal data are a person’s first and last name, phone number, personal identity number, address, factors connected to the physical appearance and details of employment, CV, as well as a person’s e-mail address, online username or identifier and IP address.

Processing of personal data is any operation or set of operations which is conducted in relation to personal data, whether or not it occurs by automatic means. Thus, processing include for example collection, recording, storage, adaptation or alteration, retrieval, transferring or otherwise making data available, combining data sets and deletion of data.

4. The personal data processed by Eltel

Eltel processes personal data in order to be able to fulfil its legal and contractual obligations and in order to establish a safe and efficient administration of its business. More specifically, Eltel will only collect and process personal data as described in the below matrix and will only process such personal data to fulfil the purposes stated in the matrix. Personal data must only be processed in accordance with applicable legislation to fulfil the purposes set out in this Data Protection Policy and the matrix.

Personal data type and source

Purpose      

Legal ground

Retention time or criteria

Identification details - i.e. name, personal   identification number, date of birth and nationality.

 

Source: From data subject or the data subject's employer

 

 

 

 

 

 

 

 

 

To enable Eltel to identify the registered person in order to fulfil all contractual obligations

Performance of a contract

During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel.

To enable Eltel to fulfil all its   obligations in relation to the contractual relationship. This includes processing of personal data for invoicing purposes, information/contact purposes, documentation of the services performed, recording transactions and planning and execution of services

Performance of a contract

To enable Eltel to manage an   effective protocol in case of emergency situations and crisis management

Legitimate interest

To enable Eltel to conduct credit ratings, ensuring confidentiality of commercially sensitive information and   security vetting

To enable Eltel to administer and maintain personal records, to create employee, customer, partner, supplier, contractor and other relevant third party databases including information regarding services provided, services received and business opportunities

To enable Eltel to publish   references on Eltel's, webpage and in external communication[1]

To enable Eltel to carry out   surveys and evaluations in order to plan, organise and manage the services to ensure the quality of work

Contact information - i.e. address, telephone number,   e-mail address, fax number.

 

Source: From data subject or the data subject's employer

To enable Eltel to make contact in order to fulfil all obligations in relation to the contractual relationship.

Performance of a contract

During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel.

To enable Eltel to administer and fulfil its obligations under mandatory law and regulatory and corporate governance obligations. This includes providing correct information to relevant authorities such as the tax agency, gathering information in relation to legal proceedings.

Legal obligation

To enable Eltel to manage an effective   protocol in case of emergency situations and crisis management

Legitimate interest

To enable Eltel to conduct credit   ratings, ensuring confidentiality of commercially sensitive information and   security vetting

To enable Eltel to administer and maintain personal records, to create employee, customer, partner, supplier, contractor and other relevant third party databases including information regarding services provided, services received and business opportunities

To enable Eltel to publish   references on Eltel's, webpage and in external communication[2]

To enable Eltel to carry out   surveys and evaluations in order to plan, organise and manage the services to ensure the quality of work

HR data – work qualifications, prior work experience, test results, CV:s

 

Source: From data subject or the data subject's employer

 

To enable Eltel to offer and   provide services to customer and partners and to participate in procurements 

Legitimate interest

During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel.

To enable Eltel to administer and maintain personal records, to create employee, customer, partner, supplier, contractor and other relevant third party databases including information regarding services provided, services received and business opportunities

Billing data - i.e. bank details, credit card numbers, and invoice information

Source: From contracting party

To enable Eltel to fulfil all its   obligations in relation to the contractual relationship. This includes processing of personal data for invoicing purposes, documentation of the services performed and recording transactions.

Performance of a contract

During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel.

To maintain accounting records and other economic records for book keeping purposes

Legal obligation

Assignment details - i.e. working time, work tasks, assignments, work description

 

 

 Source: Eltel

 

To enable Eltel to adapt its organisational structure, workforce management, project time, and to schedule and monitor work time/resource planning

Legitimate interest

During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel.

To enable Eltel to carry out surveys and evaluations in order to plan, organise and manage the services to ensure the quality of work

Communication data - i.e. correspondence with Eltel through email, telephone, fax or post and comments and reviews on surveys and   reviews) 

Source: Eltel

 

To enable Eltel to ensure correct authorisation, clearance and access to facilities and IT-systems and to monitor and ensure compliance with rules communicated regarding allowed use of the IT system and ensuring confidentiality of commercially sensitive information 

Legitimate interest

During the length of the   contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel. 

To enable Elte to administer and maintain the contractual relationship

Performance of a contract

Digital information   data - i.e. personal data collected when using Eltel services and websites and   applications including IP-addresses, browser data, traffic data and user patterns 

Source: Eltel

To enable Eltel to ensure correct authorisation, clearance and access to facilities and IT-systems and to monitor and ensure compliance with rules communicated regarding allowed use of the IT system and ensuring confidentiality of commercially sensitive   information

Legitimate interest

During the length of the contractual relationship and as long as it is required under applicable book and file keeping regulations, and for as long as a claim can be raised against Eltel.


[1] Please note that marketing information will only be disclosed if Eltel has received consent for such disclosure

[2] Please note that marketing information will only be disclosed if Eltel has received consent for such disclosure

5. How the personal data is handled

Eltel will only process personal data for the purposes it was collected and as set out in the matrix. Further processing may occur if it is legal and compatible with the purposes for which the personal data were initially collected. Eltel has taken appropriate technical and organisational measures for the protection of the personal data to ensure that only authorised persons are given access to personal data. The organisational measures taken are e.g. policies, instructions, guidelines regarding the safety and security measures as well as log management and audit trail systems.

Eltel may need to provide personal data to relevant authorities (e.g. the tax authority) based on mandatory law and in order to fulfil legal obligations.

Furthermore, due to the fact that Eltel is a part of a group of companies with business activities in several different countries, it will be necessary to transfer personal data to companies in the group outside of the registered person's own country that need to receive such personal data in order for Eltel to fulfil the purposes as stipulated in the matrix. This will always be subject to assessment according to local legislation or contractual requirements.

The personal data may also be transferred to and processed by companies within the EEA which perform services for Eltel (data processors) in order for such companies to be able to perform the services requested by Eltel. Services which may be requested are, for example, the provision of infrastructure, insurance, administration and IT services. Only personal data that is necessary in order to fulfil such purposes will be provided to such parties. The data processors are obliged to act in accordance with Eltel's instructions and to implement appropriate technical and organisational measures for the protection of the personal data.

6. Access to information

Personal data will only be available to authorized employees holding a position where it is necessary to process personal data to fulfil his or her tasks. These employees will only be granted access in accordance with the principle of least privilege, and will therefore only have access to personal data that is strictly necessary for the purpose of the processing. Accessibility, confidentiality and integrity of logs containing personal data will always be ensured. 

7. Duration of processing and deletion of personal data

Eltel will not store or process personal data for any longer time than what is necessary to fulfil the specific purposes set out in the matrix or otherwise in this Data Protection Policy or according to any mandatory applicable law. Accordingly, when the purpose has been fulfilled in relation to a specific type of personal data, Eltel will delete the relevant personal data as soon as reasonably possible.

8. Rights with regards to the personal data

A registered person has the right to request access to the personal data relating to him or her. The right of access extends to information as to whether or not personal data concerning a person is processed, the relevant personal data being processed and the purpose of such processing. A registered person also have the right to rectify or complete personal data in case the personal data is inaccurate or incomplete.

Erasure of personal data may also be requested if the personal data, inter alia, is no longer necessary in relation to the purposes for which it was collected, if the processing is unlawful or the personal data has to be erased for compliance with a legal obligation in the European Union or in a registered person's own country to which Eltel is subject. This list is not exhaustive and questions regarding the processing should be directed to Eltel if a registered person would like his/her personal data to be erased. A registered person are also entitled to object to certain processing or request that the processing of the personal data is restricted if the registered person believes that the accuracy of the personal data could be questioned, if the registered person believes that the processing is unlawful or if the registered person believes that Eltel no longer needs the personal data for the purposes as stipulated in the matrix or in this Data Protection Policy.

However, please note that even if a registered person objects to certain processing, Eltel may still need continue such processing of personal data as necessary under applicable legislation, for example to be able to fulfil legal requirements or to fulfil contractual obligations. If a registered person has any complaints on how the personal data is processed, or would like more information in any regard, he/she may contact Eltel. A registered person is also entitled to lodge a complaint regarding the data processing with the relevant supervisory authority, i.e. Datainspektionen (Sweden) – www.datainspektionen.se; Office of the Data Protection Ombudsman (Finland) - www.tietosuoja.fi; Datatilsynet (Norway) – www.datatilsynet.no; Datatilsynet (Denmark) – www.datatilsynet.dk; State Data Protection (Lithuania) – www.ada.lt; Bundesdatenschutzbeauftragte (Germany) - www.bfdi.bund.de and The Bureau of the Inspector General for the Protection of Personal Data (Poland) – www.giodo.gov.pl.

A request to exercise individual rights with regards to the processing of personal data shall be sent by email to dataprivacy@eltelnetworks.com

Please note that we may ask a registered person to confirm his/her identity to ensure that we do not disclose personal data to any unauthorized person.

9. Updates to the Data Protection Policy and non-compliance with this Data Protection Policy

In order to ensure compliance with the applicable data protection legislation, as amended from time to time, this policy may be amended by the Eltel at any given time. The applicable Data Protection Policy can always be found on eltelnetworks.com/dataprotection Any breach of the Data Protection Policy shall be reported to Eltel. Any breach of this policy will be taken seriously and may result in necessary actions being taken. Eltel maintains a written plan and process for data protection incident handling.

A registered person should notify the Eltel of any changes of the personal data relating to himself/herself in order to facilitate for an accurate and secure processing of personal data.­­­ Please find below a list of all data controllers in the different jurisdictions.

Data controller

Relevant country

Contact person

Data controller

Relevant country

Contact details and responsible person

Eltel AB

 

Sweden

Legal manager - Sweden

Eltel Networks Pohjoinen Oy

Finland

Legal manager - Finland

Eltel Networks TE AB

Sweden

Legal manager - Sweden

Eltel Networks A/S

Denmark

Legal manager - Denmark

Eltel Netweorks Infranet AB

Sweden

Legal manager - Sweden

Fiber og Anlaeg I/S

Denmark

Legal manager - Denmark

Eltel Group Oy

Finland

Legal manager - Finland

Eltel Networks AS

Norway

Legal manager - Norway

Eltel Networks Oy

Finland

Legal manager - Finland

Eltel Networks Telecom SP.z.o.o.

Poland

Legal manager - Poland

Eltel Networks Poland S.A.

Poland

Legal manager - Poland

Eltel Academy Foundation

Poland

Legal manager - Poland

Energoprojekt Krakow S.A.

Poland

Legal manager - Poland

Eltel Networks Energetyka S.A.

Poland

Legal manager - Poland

UAB Eltel Networks

Lithuania

Legal manager - Finland