Catena AB
General
Our objective is that those who contact us should feel secure with our processing of their personal data. We respect your personal integrity and take a proactive approach to protecting your personal data. In this Privacy Policy, we describe how we ensure that your personal data is processed in accordance with applicable legislation, such as the General Data Protection Regulation (GDPR).
The purpose of this policy is to provide you with clear and transparent information about how we collect and process your personal data securely. However, to ensure that the policy is not too long to read, we have highlighted the most common types of processing and the ones that can be assumed to have the greatest impact on you. You will also find information regarding your rights and how to exercise them.
What constitutes personal data?
Personal data is information that can be linked directly or indirectly to a physical, living person.
Controller
Catena AB (henceforth “Catena”), Corp. Reg. No. 556294-1715, with address Box 5003, SE-25005 Helsingborg, Sweden, tel. +46 (0)42 449 22 00, e-mail info@catena.se, is controller for the personal data we process and which is described in this policy.
Third party links
Our website contains links to other websites. Catena is not responsible for the processing of data that takes place via or on these websites.
How to navigate this policy
To help you find the relevant information on the data we process, why we do so and for how long, we have chosen to layer the information based on the relationship we have with you. If you are a contact at or represent one of our customers, you will find information under the heading “Contact person at customer.” If you are an employee of one of our suppliers, you can find information under the heading "Employee of our supplier". If you subscribe to our newsletter, you can find information under the heading “Subscribers, newsletter”, if you have visited one of our properties, you can find more information under “Visitors to our properties”, etc. Some personal data is processed for purposes that are common to everyone, regardless of how you have come into contact with us. You can find a description of these in the table below.
Contact person at customer
When we sign an agreement with a company, we will collect necessary contact details to ensure that we can provide our services, communicate important information and send out invites to events and surveys. We will also process your personal data if it is necessary to enable us to manage and respond to legal requirements or to protect our rights.
|
Purpose |
To fulfil our commitments to customers, provide our services and offer good customer care as well as communicate important information. Some information may also be used to fulfil legal obligations, such as the Swedish Bookkeeping Act. |
|
Types of personal data |
Name, address, telephone number and e-mail. Personal ID number if you are a sole proprietor. |
|
Legal basis |
Legitimate interest and legal obligation. |
|
Time interval |
For as long as you represent our customer and for a period of 12 months thereafter. We will update our systems as soon as we receive information on the appointment of a new contact person. We may process your data for longer in, for example, emails and documents, if it is necessary as a basis for an agreement between Catena and your employer. For accounting purposes, the data is stored for 10 years. If we process your personal data to establish, exercise or defend legal claims, our processing will continue for the duration of such a process. |
Tenants (private individuals)
When you as a private individual enter into a lease agreement with Catena, we will process your personal data for administration and delivery, to fulfil our commitment to you and invoice for our services. If you contact us with questions, opinions or complaints, we will need to process your contact details in order to help you. In addition to the information you submit to us, we may need to request information from credit reporting agencies, Lantmäteriet as well as public records and coordinate that data with the information you have submitted to us. We will also process your personal data if it is necessary to enable us to manage and respond to legal requirements or to protect our rights.
|
Purpose |
To administer and fulfil our commitments under the lease agreement as well as our accounting obligations. We may also process your personal data if it is necessary for the protect of our rights.s well as our accounting obligations. |
|
Types of personal data |
Name, address, Personal ID number, telephone number, e-mail, payment details and details of the tenancy. |
|
Legal basis |
Agreement and legal obligation, respectively. If we process your personal data to manage a legal claim or to defend our rights, we base the processing on our legitimate interest. |
|
Time interval |
As long as we have a contractual relationship with you and for a period of 12 months thereafter. For accounting purposes, the data is kept for ten years. If we end up in a legal dispute with you, we will process your personal data for as long as it is necessary to defend our rights.ion is stored in accounts for ten years. |
Subscribers, newsletter
We distribute information and marketing material to our newsletter subscribers. The information is collected when you grant consent, which could be via our website or through face-to-face contact if we meet at a trade fair or other event. This will allow Catena to tailor the newsletter based on the preferences and needs you specified.
|
Purpose |
To market offers from ourselves and/or carefully selected partners and to distribute relevant information. |
|
Types of personal data |
Name and e-mail. |
|
Legal basis |
Consent. |
|
Time interval |
For as long as we have your consent. If you withdraw your consent, we will stop sending the newsletter to you (read more in the “your rights” section). |
Visitors to our properties
Some of Catena’s properties have access and surveillance systems, a few of which are administered by Catena. All persons working in or visiting Catenas properties have an interest in the properties’ access and surveillance systems for the purpose of security, order and crime prevention. Camera surveillance is conducted in accordance with the Camera Surveillance Act and the limitations pursuant to the General Data Protection Regulation.
|
Purpose |
We have installed an access and surveillance system to improve safety and security at and in properties |
|
Types of personal data |
Film recording, without sound and localisation data, for example in the form of tag registration. |
|
Legal basis |
Legitimate interest. The risk is deemed reasonable compared with the risk of being subjected to criminal offences if the security cameras had not been installed in the property. |
|
Time interval |
No more than two months from recording and/or registration, unless the recording is needed for the establishment, exercise or defence of legal claims. In case of suspicion of a crime, the photographic material may be disclosed to the police and, when investigating damage, may also be shared with the claims handlers. |
Event participants
If you, or someone at your workplace, has registered you for an event that we are arranging, either ourselves or together with others, we will process your personal data to enable your participation and ensure that you have the best possible experience. The information we collect in connection with the event may include health details (food allergies).
|
Purpose |
To administer your participation, take into account food preferences and adapt to your wishes. |
|
Types of personal data |
Name, e-mail, telephone number, company, food preferences and allergies. |
|
Legal basis |
Consent and legitimate interest. |
|
Time interval |
The information will be erased when the event is over. For recurring events, participants from the previous event are saved until the latest event is over. |
Website visitors
If you agree to cookies on our website, we can modify it to reflect how you as a visitor use our website. Read more in our cookie policy.
|
Purpose |
To analyse the use of our website and modify it to reflect the visitor’s experience. |
|
Types of personal data |
IP address and operating system, response time for pages, download errors, how you reached and left our website |
|
Legal basis |
Consent |
|
Time interval |
Each cookie has a unique storage period, see more information in our cookie policy. |
Recruitment processes
When you apply for a position or show interest in working with Catena via unsolicited application, we process your personal data.
|
Purpose |
When recruiting new employees, the processing of personal data is necessary. For some positions, we will check the background before we offer employment and sometimes we also request certificates, such as study grades. When this is the case, we will obtain your consent at a later stage in the recruitment process and not when you apply for the position. |
|
Types of personal data |
The information consists of information you provide in connection with your application or registration of interest such as name, contact information, date of birth, CV, personal letter, certificate and / or study grades, previous and / or current employer and any other information that you voluntarily provide to us .We may also process personal data that consists of notes about you from interviews, reference interviews and results from any tests and background checks. |
|
Legal basis |
Legitimate interest |
|
Time interval |
If you appication relates to an advertised position and your application does not lead to an offer of employment, we will save yout data for two years, in case we should need it for any potential discrimination claim. If you have made a unsolicited application, we will save your personal information for two years. |
Wistleblowing
We may process your personal data to fulfil our legal obligation to provide a whistleblowing function, if you choose to have your personal data included in the report submitted to our reporting channel.
|
Purpose |
To fulfil our legal obligation to provide a reporting channel. |
|
Types of personal data |
Personal data contained in the report received. This may include name, contact details, professional role, place of work and information related to the misconduct in the public interest. |
|
Legal basis |
Legal obligation. |
|
Time interval |
Personal data resulting from a follow-up case after a report has been received is only processed as long as the need for it remains. Personal data needed for documentation purposes is kept for a maximum of two years after the case has been closed. |
Who could we share your information with?
Catena may share your personal data with other controllers. For example, tenant organisations, insurance companies or debt collection companies. The sharing of your personal data with other data controllers takes place in order to achieve the same purpose and with the same legal basis as the personal data was collected for and on the basis of. It is the other controller that is responsible for its own processing of your personal data.
In cases where we cooperate with another actor, for example to organise an event, we may share personal data between us for similar purposes and then act as a joint data controller.
In order to fulfil the purposes of the processing of your personal data, we use external parties who act entirely on our instructions, so-called data processors. When we use data processors, the processing is based on the same legal grounds and for the same purposes as described in this policy. We take technical and organisational security measures to ensure that your personal data is processed in a secure manner. We also enter into data processor agreements to regulate the responsibility between us and our processors.
We have listed the categories of recipients with whom your personal data may be shared:
Suppliers and subcontractors: Catena uses third-party suppliers to manage parts of the business, such as IT and system suppliers for communication programmes, CRM systems and the like. We may share personal data with these suppliers when they perform services on our behalf.
Banks and partners: Catena shares your personal data with other independent data controllers such as banks and partners. These recipients independently manage and are responsible for the processing of your personal data.
Companies within the group: Catena may share your personal data with other companies within the group, if it is necessary to fulfil the purposes stated in this information.
Social media: Catena uses social media. When using social media, your personal data is collected and processed by these companies. See each company's privacy policy for more information.
Authorities: We will also disclose your personal data to authorities, such as the Swedish Tax Agency, if it is required by law, a decision by an authority or a court order, or if we reasonably believe that the disclosure is necessary to protect our rights.
Catena will not sell your personal data to third parties without your prior authorisation. We may transfer your personal data to a buyer/investor or potential buyer/investor in connection with a restructuring, sale or other transfer of all or part of Catena's shares, assets or our business in general. Upon such transfer, we will take steps to ensure that the receiving party processes your personal data in a manner consistent with this notice.
Transfers to third countries
When we transfer your personal data to a supplier, partner or other provider, we do this to receive help in performing certain processing activities. When such a recipient is located in a third country (a country outside EU/EEA), we choose our recipients with particular care and ensure they can offer us security measures so you can feel safe with how we are processing your personal data.
For all of these transfers, we ensure that standard contractual clauses (SCCs) have been signed, or an equivalent approved transfer mechanism is in place in accordance with Chapter V of the GDPR. This is to ensure as far as possible that the information is processed as securely as if the recipient had been located in the EU/EEA. However, despite this we wish to inform you that national legislation in recipient countries (such as the US) in some cases may allow their authorities to access the information through their security legislation.
The following recipients outside the EU/EEA may be considered:
Suppliers and subcontractors: We may share your personal data with suppliers and subcontractors outside the EU/EEA. This may include, for example, suppliers of IT services. Here we list suppliers and subcontractors outside the EU/EEA.
Microsoft Office 365: By using the service, your personal data will be processed by the company Microsoft Corporation. When Microsoft receives your personal data, the personal data may be transferred to, for example, the United States. You can read more about Microsoft's processing here and about their transfers to third countries here.
Social media: When you visit, appear on or otherwise use Catena's social media channels, your personal data is also collected and processed by the company that owns the respective social media. In connection with these companies receiving your personal data via Catena's channels, the personal data may be transferred to, for example, the USA. Here we list the social media on which Catena has channels.
Facebook and Instagram: By using the services, your personal data is processed by the company Meta Platforms Ireland Ltd. You can read more about the processing of personal data here. You can read more about the transfer of the services to third countries and the standard contractual clauses here.
LinkedIn: By using the services, your personal data is processed by Microsoft Corporation. You can read more about Microsoft's processing here and about their transfers to third countries here.
Youtube: By using the service, your personal data is processed by the company Google LLC. You can read more about the processing of personal data and the service's transfer to third countries here.
Your rights
As described in the introduction, our Privacy Policy only includes the most common types of processing and those that can be assumed to impact you most. This is to avoid it becoming too long and complicated. If you would like a more detailed description of specific information we have about you, you can always utilise your right of access, described below, or send us a question.
Right of access
You are entitled to receive a register excerpt from Catena including the personal data registered about you, the purposes for which the data has been processed and to what recipients the data has, or may be, divulged. Requests for access must be made in writing and identification must be proven in a secure manner. You also have the right to receive a copy of the personal data. Please note that this does not mean that you have the right to the documents containing the personal data. We may also request additional information to enable us to identify you.
Right to erasure
You are entitled to request that your personal data is erased, if the processing of personal data is, for example, no longer required for the purposes for which they are processed, is based on your consent and you withdraw this or if your personal data is processed illegally. However, erasure does not apply to personal data that we are obliged to maintain in accordance with legal obligations or that we must process for the establishment, exercise or defence of legal claims.
It is important that you are aware that your personal data is often processed for various, separate purposes, in different systems, and your name may therefore remain in our systems to enable us deliver in accordance with tenant agreements, even though the personal data has been removed, for example, for marketing purposes.
Right to rectification
You are entitled to request rectification of the personal data being processed about you if this is inaccurate and you have the right to request that we supplement incomplete personal data.
Right to object and/or limit the processing of your personal data
You have the right to object to or restrict processing operations carried out on your personal data. For example, you can restrict the processing of your personal data temporarily if you believe that the personal data was/is inaccurate - giving us time to investigate. You also have the right to specifically object to the processing operations described below:
Legitimate interest
You are entitled to object to the processing of your personal data based on legitimate interest. This means we only have the right to continue processing your personal data if we can demonstrate that our legitimate interest exceeds your interest in ending the processing and your rights. This only applies to personal data processing performed pursuant to the legal basis of legitimate interest.
Direct marketing
If you do not wish Catena to process your personal data for marketing purposes, you are entitled to withdraw your consent at any time and to unsubscribe from our marketing announcements. You are also entitled to file an objection and we will then immediately cease to process your data for that purpose. When we have received your revocation or objection, we will cease to process the personal data for direct marketing.
Right to data portability
If processing is based on consent or agreement and where technically feasible, you are entitled to data portability, which means we will help you to transfer personal data to you, or the individual you choose, in a machine-readable format. This relates only to data that is available in a structured format and that you have provided to us.
Contact us
If you wish to exercise any of your rights or have questions, contact us on info@catena.se or write to Catena AB, Box 5003, SE-25005 Helsingborg, Sweden.
Contact with supervisory authority
You are entitled to lodge a complaint with the Swedish Authority for Privacy Protection if you believe Catena is processing your personal data contrary to applicable data protection laws. We would appreciate if you first contact us so that we have an opportunity to solve any problems. You can find more information on: https://www.imy.se/privatperson/utfora-arenden/lamna-ett-klagomal/.
Updates to this Privacy Policy
From time to time, we may make changes to our Privacy Policy as we develop our offering. We will inform you if you are affected by significant changes. The latest version is always available on our website.
History, all versions:
| Ver. 1.0 | 22 May 2018 | |
| Ver. 1.1 | 2 October 2019 | (update concerning photo and video) |
| Ver. 1.2 | 30 November 2021 | (change of disposition and clarification) |
| Ver. 1.3 | April 2024 | (update on issues such as wistleblowing, recuitment, third countries etc.) |