External privacy notice

Global scope

Alleima’s data protection framework is based on the principles of Regulation (EU) 2016/679 (the “EU GDPR”) and the UK General Data Protection Regulation, as retained EU law under Section 3 of the European Union (Withdrawal) Act 2018 (the “UK GDPR”) (together, the “GDPR”). These principles guide our global approach to the protection of personal data.

The rights described in this privacy notice reflect the requirements of applicable data protection laws and apply to the extent such laws govern the relevant processing activity. Your rights may vary based on your location, the Alleima entity involved, and how your personal data is processed.

This privacy notice applies to all Alleima entities globally, in their respective roles as data controllers (or equivalent), unless otherwise specified. Where local data protection laws impose additional or differing requirements, or where specific processing activities require further detail, such information may be provided through local privacy notices, supplemental disclosures, or specific contractual arrangements.

This privacy notice covers you who:

• Visit and interact with our website and digital channels.
• Represent or are a contact person of a customer that we do business with.
• Make purchases or otherwise interact with an Alleima customer platform as a user.
• Represent or are a contact person of a prospective customer.
• Represent or are a contact person of a supplier, partner or any other commercial or administrative intermediaries (such as agents and customs brokers) that we do business with.
• Are a shareholder or a board member in any of the Alleima companies.
• Otherwise interact with us, for example if you visit any of our offices or facilities, register for an event or otherwise communicates with us.

In this privacy notice, “website” refers to “alleima.com” and “kanthal.com” and any associated subpages or related webpages thereof.

We have stated the Alleima company or companies that are responsible (as data controllers) for the processing of your personal data in relation to each processing activity. For more information, see the detailed information about our processing of your personal data.

For more information about the relevant Alleima entities, please click here.

Main principles

The Alleima company that is responsible (data controller) for the processing of your personal data under this privacy notice is normally the company:

• Which has a business relationship with the organisation that you represent or of which you are a contract person.
• In which you are a shareholder or a board member.
• With which you otherwise interact or communicate.

If you visit “alleima.com”, Alleima EMEA AB will generally act as data controller for the processing of your personal data collected through cookies and other tracking technologies.

If you visit “kanthal.com”, Kanthal AB will generally as data controller for the processing of your personal data collected through cookies and other tracking technologies.

If you use a specific customer platform, the entity responsible for operating that platform will act as the data controller for the processing of personal data in connection with such use, for example Alleima Tube AB in relation to the e-commerce solution e-Track and Kanthal AB in relation to the Kanthal e-shop.

Joint controllers

In some cases, several Alleima companies will jointly decide how and why your personal data is used. In these scenarios, these companies will be jointly responsible (act as joint controllers) for the processing of your personal data.

Alleima has entered into the Alleima Intra-Group Data Transfer Agreement (AIGDTA) that sets out the roles and responsibilities of each Alleima entity when processing your personal data. You have the right to obtain the essence of this arrangement upon request. This privacy notice also reflects the key elements of that arrangement.

In the below table we describe what categories of personal data that we process with examples of types of personal data covered by each category.

The personal data that we collect about you is mainly collected directly from yourself when you provide your personal data to us, for example when you contact or otherwise communicate with us and visit any of our website or other digital channels.

We also collect, where necessary, personal data from other sources as described below.

• Group companies, which have collected your personal data and shared them with us, for example in connection with communication,
• The company or organisation that you work for,
• Social network platforms if you follow or interact with us on social media,
• Partners that we collaborate with, for example to carry out events or similar activities,
• External persons that we communicate with for the purposes described in this privacy notice.

We collect and use personal data for various purposes. The purposes for which we in practice process your personal data may, however, vary depending on your relationship with us or how you interact with us.

To read more about which personal data, which legal basis that we rely on for the processing of your personal data for each purpose and for how long your personal data is stored in relation to the relevant categories of individuals, please see our detailed information on our use of personal data.

Transfer of personal data to other external recipients (controllers)

We share your personal data with various external recipients, where necessary, for the purposes for which we process your personal data as described in this privacy notice. These recipients are responsible (controllers) for their own processing of your personal data, unless we have stated otherwise.

To read more about for which purposes that we share your personal data and the legal bases for such sharing, please see our detailed information on our use of personal data, where we have outlined in relation to each purpose for processing of personal data the external recipients that we share your personal data with.

Transfer of personal data to service providers (processors)

We also transfer personal data to service providers that we have engaged when necessary for the purposes for which we process personal data as described in this privacy notice.

These service providers provide, for example, IT services, development services and communication services to us. The services providers which process personal data on our behalf and in accordance with our instructions act as data processors in relation to us. These service providers may not process your personal data for their own purposes and are legally and contractually obligated to protect your personal data.

Where we process your personal data

As a main rule, we store your personal data within the EU/EEA. However, in certain cases, we transfer your personal data to recipients located in third countries outside the EU/EEA, for example to service providers engaged by us or Alleima group companies in such countries.

To ensure an essentially equivalent level of protection for your personal data when transferred (or otherwise made available) to service providers in third countries which do not provide an adequate level of protection, we generally rely on the EU Commission's adopted standard contractual clauses for international transfers according to decision 2021/914 and implement supplementary measures as necessary to ensure an essentially equivalent level of protection for your personal data as provided under the EU GDPR.

We also rely upon adequacy decisions issued by the EU Commission where personal data is transferred to countries and recipients covered by such decisions (i.e. where the EU Commission has determined that such country and/or recipient provides an adequate protection). By way of example, this includes the EU-US Data Privacy Framework for transfers to the United States and the UK adequacy decision for transfers to the United Kingdom.

Similarly, where your personal data is processed by an Alleima entity in the UK, transfers of personal data outside the UK (restricted transfers) will only occur where the recipient is located in a country or territory subject to an “adequacy regulation” issued by the UK Government. This includes, for example, transfers to the EU/EEA and the United States. Transfers to other countries that are not subject to adequacy regulations may also occur, in which case we rely on the UK-approved standard data protection clauses for restricted transfers, and implement supplementary measures as necessary to ensure an essentially equivalent level of protection for your personal data as provided under the UK GDPR.

Rights in relation to the use of your personal data

You have the following rights in relation to your personal data under the GDPR:

• Access to and receive a copy of your personal data (Article 15).
• Rectify or supplement your personal data (Article 16).
• Withdraw your consent to a processing of your personal data (Article 7).
• Delete your personal data (Article 17).
• Object to a processing of your personal data (Article 21).
• Restrict a processing of your personal data (Article 18).
• Obtain a copy of your personal data and have your personal data transferred to an external recipient (data portability) (Article 20).

Where the UK GDPR applies, for example if your personal data is processed by an Alleima company established in the UK, you also have the right to lodge a complaint about our processing of your personal data (Section 164A of the Data Protection Act 2018, as amended by the (Data Use and Access) Act 2025).

Automated individual decision-making

We do not carry out any automated individual decision-making which have legal effects or similar significant effects on you.

Further information on your rights

Please note that each right above comes with certain caveats and exemptions. This means that these rights only may be successfully exercised in certain situations. For more information on your rights and when they apply, see for example the information provided by the Swedish Authority for Privacy Protection available on their website.

Exercise your rights

If you wish to exercise your rights at any time, please contact by using the form on our website.

If possible, we would grateful if you use the e-mail address that you have registered with us or used when you have previously been in contact with us. This would make it easier for us to manage your request.

Right to lodge a complaint

You have the right to lodge a complaint with your supervisory authority. Contact details to the data protection authorities in the EU/EEA can be found here.

Where the UK GDPR applies, for example if your personal data is processed by an Alleima company established in the UK, you also have the right to lodge a complaint with us about how we process your personal data. If you wish to lodge such a complaint, please contact us by using the form on our website.

Contact details to the supervisory authority in the UK, the Information Commissioner’s Office (ICO), can be found here.

Please contact us by e-mail at privacy@alleima.com if you have any questions about this privacy notice, how we use your personal data or if you wish to exercise your rights.

You can also find contact details to each Alleima entity here.

Contact details to our appointed Data Protection Officer in Germany: datenschutz@atarax.de.

Follow up on and evaluate the use of our website and digital channels

Examples of what we do: We process your personal data to better understand how our website and digital channels are used, for example by analysing numbers of visitors and activities on our webpages. This is carried out by using cookies and similar technologies which allow us to analyse visitor and user statistics.

Categories of personal data:

• User generated data
• Technical data

Legal basis:

Consent (Article 6.1 (a) of the GDPR). The processing relies on the consent that you provide by accepting the use of cookies and similar technologies for the same purpose.

Storage period: Personal data is stored during the period stated in our cookie policy available on the website.

Data controller: Alleima EMEA AB acts as the sole controller if you visit “alleima.com”. Kanthal AB acts as the sole controller if you visit “kanthal.com”.

Improve the user experience on our website and in our digital channels

Examples of what we do: We process your personal data to provide a more personalised and user-friendly experience when visiting our website and digital channels. This is carried out by using cookies and similar technologies which inter alia allow us to remember user preferences such as language, screen and device settings.

Categories of personal data:

• User generated data
• Technical data

Legal basis:

Consent (Article 6.1 (a) of the GDPR). The processing relies on the consent that you provide by accepting the use of cookies and similar technologies for the same purpose.

Storage period: Personal data is stored during the period stated in our cookie policy available on the website.

Data controller: Alleima EMEA AB acts as the sole controller if you visit “alleima.com”. Kanthal AB acts as the sole controller if you visit “kanthal.com”.

Provide marketing and tailored content on our website and in our digital channels

Examples of what we do: If you visit our website or digital channels, we collect your personal data by using cookies and similar technologies to provide you with marketing and other tailored content which we believe are of interest to you, for example based on your interactions with our digital channels, including our website (such as browsing behaviour and websites visited).

Categories of personal data:

• User generated data
• Technical data

Legal basis:

Consent (Article 6.1 (a) of the GDPR). The use of your personal data relies on the consent that you provide by accepting the use of cookies and similar technologies for the same purpose.

External recipients:

1. Social media providers

Storage period: Personal data is stored during the period stated in our cookie policy available on the website.

Data controller: Alleima EMEA AB acts as the sole controller if you visit “alleima.com”. Kanthal AB acts as the sole controller if you visit “kanthal.com”.

Ensure functionality on our website and in our digital channels

Examples of what we do: We process your personal data to ensure necessary technical functionality and security on our website and in our digital channels, for example by using strictly necessary cookies and other technologies on these platforms.

Since the cookies and similar technologies are necessary in order to provide our website as intended, your consent to our use of cookies and similar technologies is not needed.

Categories of personal data:

• Technical data

Legal basis:

Legitimate interest (Article 6.1 f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of ensuring technical functionality on our website and in our digital channels.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, given the purpose of the processing as such and that only basic personal data is processed for this purpose.

Storage period: Personal data is stored during the period stated in our cookie policy available on the website.

Data controller: Alleima EMEA AB acts as the sole controller if you visit “alleima.com”. Kanthal AB acts as the sole controller if you visit “kanthal.com”.

Provide newsletters and other business communication

Examples of what we do: If you have signed up for our newsletter or similar communication relating to Alleima’s business and products, we process your personal data to send you such business-related communication, including registering you in our sending list.

We will only send you communication for marketing purposes if you have provided your consent to this, which you normally do by actively signing up for the relevant communication.

Categories of personal data:

• Identity data
• Contact information

Legal basis:

Consent (Article 6.1 (a) of the GDPR). The processing of your personal data is based on your consent to obtain newsletters and similar communication.

Storage period: Personal data is stored for this purpose until you withdraw your consent, which you do by unsubscribing to the communication.

You can always unsubscribe from the relevant communication by clicking on the unsubscribe link in the e-mail or similar communication field or by contacting us.

Data controller: If you have signed up for our newsletter or similar communication at “alleima.com”, the relevant Alleima company (depending, for example, on the area or products you are interested in and the country you choose), acts as the sole controller. If you have signed up at “kanthal.com”, Kanthal AB acts as the sole controller.

Verify the identity of customers and assess risks

Examples of what we do: We process your personal data to verify the identity of the representatives of the customer, including assessing any related customer-related risks. By way of example, this includes know your customer (KYC) checks as appropriate (such as ID and document verification) and other measures to comply with applicable laws aiming to prevent money laundering and terrorism financing.

Categories of personal data:

• Communication data
• Contact information
• Identity data
• Organisational data
• Background check data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest in identifying and assessing business risks prior to entering into a relationship with a customer.

Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, since we otherwise would not be able to make such informed decisions.

Fulfil legal obligation (Article 6.1 (c) of the GDPR). Where we need to take measures to comply with applicable legislation, for example to prevent money laundering and terrorism financing, the processing of your personal data is necessary to fulfil such legal obligation.

Any information relating to criminal offences will only be processed where necessary to fulfil a legal obligation.

External recipients:

1. Group companies

Storage period: Personal data is stored for this purpose as long as there is an active relationship with the customer, including as long as necessary under applicable laws.

Data controller: The Alleima company having a business relationship with the organisation that you represent or of which you are a contract person acts as the sole controller.

Manage the business relationship with customers

Examples of what we do: We process your personal data to manage the customer relationship, for example to communicate with you as a contact person or representative of such organisation about products, safety matters and technical changes, fulfil our product maintenance obligations, register you as a contact person as well as manage orders, shipments and invoices.

Categories of personal data:

• Communication data
• Contact information
• Identity data
• Organisational data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest in managing the business relationship with our customers and thereby fulfil our rights and obligations under relevant contracts.

Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, since we otherwise would not be able to manage the relationship.

External recipients:

1. Group companies

Storage period: Personal data is stored for this purpose as long as there is an active relationship with the customer.

Data controller: The Alleima company having a business relationship with the organisation that you represent or of which you are a contract person acts as the sole controller.

Manage complaints, warranties and refunds

Examples of what we do: We process your personal data to receive, manage and assess complaints, warranty claims and refunds by you relating to our products and services.

Categories of personal data:

• Identity data
• Organisational data
• Event data
• Communication data
• Contact information

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of managing the complaint, warranty claim or refund.

Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, since we otherwise would not be able to manage our contractual obligations and rights in relation to the business you represent.

External recipients:

1. Group companies
2. Insurance companies

Storage period: Personal data is stored for this purpose for as long as necessary to manage the specific complaint, warranty claim or refund.

Data controller: The Alleima company having a business relationship with the organisation that you represent or of which you are a contract person acts as the sole controller.

Follow up on and evaluate sales and campaigns

Examples of what we do: We process your personal data to follow up on and evaluate our sales and campaigns that we carry out, for example to compile statistics of orders and in general to better understand what services and products that are used by our customers and how. This in order for us to obtain a better understanding and insight in our customers' behaviours and patterns, to allow us to develop and improve our business for the benefit of our customers.

We do not carry out any profiling activities in relation to your personal data for this purpose, since analyses are made on an aggregated level. We are not interested in your specific behaviour, but instead our customers' behaviours on an aggregated level.

Categories of personal data:

• Communication data
• Feedback data
• Identity data
• Organisational data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of follow up on and evaluate our sales and campaigns that we carry out.

Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since reports and statistics only are saved on an aggregated level and that the information therefore cannot be related to you.

Storage period: Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice.

Data controller: The Alleima company having a business relationship with the organisation that you represent or of which you are a contract person acts as the sole controller.

Provide offers and marketing

Examples of what we do: We process your personal data to provide you offers and marketing in different channels, for example via e-mail, regarding our products and services.

No profiling will take place in connection with this processing. However, we may tailor which target groups that shall receive a certain offer or marketing communication on an organisation level, for example based on where the customer is established geographically, on previous orders and you position/role – to ensure that the communication is relevant for you.

We will only send you communication for marketing purposes if you have not objected (opted out) to such communication.

Categories of personal data:

• Contact information
• Identity data
• Organisational data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of providing you with relevant offers and marketing.

Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since you always may decline or unsubscribe to such communication for this purpose and since we have a professional relationship to you.

Storage period: Personal data is stored for this purpose as long as we have an active customer relationship with the customer that you represent.

You can always unsubscribe from the relevant communication by clicking on the unsubscribe link in the e-mail or similar communication field or by contacting us.

Data controller: The Alleima company responsible for providing offers and marketing to you acts as the sole controller.

Conduct surveys to improve and develop our products and services

Examples of what we do: We process your personal data to improve and develop our products and services. By way of example, this involves conducting customer surveys, including determining to which target group we shall send a survey, which questions to be asked in a survey, sending out the survey and collecting and analysing the results from a survey. Your opinions about our business are important to us.

You can always unsubscribe from our communication about surveys by clicking on the unsubscribe link in the e-mail or similar communication field or by contacting us.

Categories of personal data:

• Communication data
• Contact information
• Feedback data
• Identity data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of carrying out surveys in order to obtain your opinions of our business.

Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since it is voluntary to participate in surveys.

Storage period: Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice.

Data controller: The Alleima company conducting the relevant surveys and collecting and analysing the results acts as the sole controller.

Carry out analysis for method and business development

Examples of what we do: We process your personal data to carry out analyses for method and business development. It is important for us that continuously develop our products and services to meet your and other customers’ expectations and demands, including for us to work more efficient.

We do not carry out any profiling activities in relation to your personal data for this purpose, since analyses are made on an aggregated level. We are not interested in your specific behaviour, but instead our customers' behaviours on an aggregated level.

Categories of personal data:

• Communication data
• Event data
• Identity data
• Organisational data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of carrying out analyses to develop our methods and business.

Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, since reports and statistics only is saved on an aggregated level and that the information therefore cannot be related to you.

External recipients:

1. Group companies

Storage period: Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice.

Data controller: The Alleima company carrying out the relevant analysis acts as the sole controller.

Manage your user account and access to the customer platform

Examples of what we do: If you have received access to an Alleima customer platform, we process your personal data to manage your user account to such platform, for example to set up your user account in order to allow you access to our service and the features within the platform.

Categories of personal data:

• Identity data
• Account details
• Organisational data
• Contact information

Legal basis:

Performance of the agreement with you (Article 6.1 (b) of the GDPR). The processing of your personal data is necessary to fulfil the agreement with you according to the applicable user terms and conditions.

External recipients:

1. Group companies

Storage period: Personal data is stored for this purpose for as long as your user account is active.

Data controller: The Alleima company responsible for operating the platform acts as the sole controller.

Ensure functionality on the customer platform

Examples of what we do: We process your personal data to ensure necessary technical functionality and security on our customer platform, for example by using strictly necessary cookies and other technologies.

Since the cookies and similar technologies are necessary in order to provide our platform as intended, your consent to our use of cookies and similar technologies is not needed.

Categories of personal data:

• Technical data

Legal basis:

Legitimate interest (Article 6.1 f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of ensuring technical functionality on our platform.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, given the purpose of the processing as such and that only basic personal data is processed for this purpose.

Storage period: Personal data is stored during the period stated in our cookie policy available on the platform.

Data controller: The Alleima company responsible for operating the platform acts as the sole controller.

Communicate with you regarding our services and products

Examples of what we do: We process your personal data to communicate with you about our services and products, for example if you represent or is a contact person of an organisation that has shown interest in our services and products by interacting with us via e-mail or if we otherwise have reasons to believe that the relevant organisation is interested in our services and products.

We will only use your personal data for marketing purposes if you have not objected (opted out) to such communication.

Categories of personal data:

• Communication data
• Contact information
• Identity data
• Organisational data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The use of your personal data is necessary to satisfy our legitimate interest of communicating with you about our services and products.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since only limited personal data would be used for this purpose and that you can always opt-out from the processing.

Storage period: Personal data is stored for this purpose for as long as we consider such communication to be relevant to you.

You can always unsubscribe from the relevant communication by clicking on the unsubscribe link in the e-mail or similar communication field or by contacting us.

Data controller: The Alleima company that is seeking a business relationship with the organisation you represent or of which you are a contract person acts as the sole controller.

Carry out sales meetings and demos

Examples of what we do: We process your personal data to carry out sales meetings and demos of our services and products, including communicating with you for the same purpose.

Categories of personal data:

• Picture, video and audio material
• Identity data
• Communication data
• Contact information
• Organisational data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The use of your personal data is necessary to satisfy our legitimate interest of carrying out sales meetings and demos.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, given the limited impact that the processing of personal data may have.

Storage period: Personal data is stored for this purpose during the period the meeting or activity is carried out.

Data controller: The Alleima company that is seeking a business relationship with the organisation you represent or of which you are a contract person acts as the sole controller.

Manage the relationship with suppliers, partners and intermediaries

Examples of what we do: We process your personal data to manage our business relationship with the company or organisation that you work for or represent, for example to register you as a contact person, manage invoices and to communicate with you.

We also process your personal data where necessary to register orders for products and services, respond to requests for proposals (RFPs) and communicate with you for the same purpose.

Categories of personal data:

• Communication data
• Contact information
• Identity data
• Organisational data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of managing the business relationship with our suppliers, partners and intermediaries.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since we otherwise would not be able to manage the relationship with the company or organisation that you represent.

External recipients:

1. Group companies

Storage period: Personal data is stored for this purpose as long as there is an active business relationship with the company or organisation that you work for or represent.

Data controller: The Alleima company having a business relationship with the organisation that you represent or of which you are a contract person acts as the sole controller.

Follow up and evaluate the supplier, partner and intermediary relationship

Examples of what we do: We process your personal data to evaluate the relationship with the company or organisation that you work for or represent, for example by generating statistics on orders of products and services. This to better understand how the relationship is working between us and the relevant supplier or partner.

Categories of personal data:

• Communication data
• Contact information
• Identity data
• Organisational data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of following up and evaluating the supplier, partner or intermediary relationship.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since reports and statistics only are saved on an aggregated level and that the information therefore cannot be related to you.

Storage period: Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice.

Data controller: The Alleima company having a business relationship with the organisation that you represent or of which you are a contract person acts as the sole controller.

Manage the shareholder register

Examples of what we do: If you are an Alleima company shareholder, we process your personal data to man-age and keep our shareholder register up to date in accordance with applicable law.

Categories of personal data:

• Contact information
• Identity data
• Organisational data
• Shareholder information

Legal basis:

Fulfil legal obligation (Article 6.1 (c) of the GDPR). The processing of your personal data is necessary to fulfil our legal obligations to manage and keep our shareholder register up to date in accordance with applicable laws.

External recipients:

1. Central Securities De-positories (CSDs)
2. Group companies

Storage period: Personal data is stored for this purpose as long as necessary under applicable laws. By way of example, if you are a shareholder of an Alleima company established in Sweden, your personal data will be kept for a minimum period of ten years following the dissolution of the relevant Alleima company, in accord-ance with the Swedish Companies Act (2005:551).

Data controller: Alleima AB acts as the sole controller.

Administer, invite to and carry out shareholder’s meetings

Examples of what we do: We process your personal data to prepare for, invite to and carry out shareholders’ meetings (or other meetings with shareholders as necessary), which includes for example to administer the voting and decide upon dividends.

Categories of personal data:

• Contact information
• Identity data
• Organisational data
• Shareholder information
• Communication data

Legal basis:

Fulfil legal obligation (Article 6.1 (c) of the GDPR). The use of your personal data is necessary to manage and carry out shareholders’ meetings in accordance with applicable laws.

External recipients:

1. Other shareholders and representatives
2. Public authorities

Storage period: Personal data is stored for this purpose as long as necessary under applicable laws. By way of example, if you are a shareholder of an Alleima company established in Sweden, your personal data will be stored and made available to all shareholders for a minimum period of ten years following the dissolution of the relevant Alleima company, in accordance with the Swedish Companies Act (2005:551).

Data controller: Alleima EMEA AB and Alleima AB act as joint controllers.

Manage the relationship with the shareholder in general

Examples of what we do: If a shareholders’ agreement has been entered into between you and the relevant Alleima company, we process your personal data to manage our relationship with you, in order to fulfil our rights and obligations under the shareholders’ agreement between you and the relevant Alleima company.

Categories of personal data:

• Contact information
• Identity data
• Organisational data
• Shareholder information
• Communication data

Legal basis:

Performance of contract (Article 6.1 (b) of the GDPR). The processing of your personal data is necessary to fulfil our rights and obligations under the shareholders’ agreement be-tween you and the relevant Alleima company.

Legitimate interest (Article 6.1 (f) of the GDPR). If you are a representative of a shareholder (i.e. a legal person), the processing of your personal data is necessary to satisfy our legitimate interest in fulfilling our rights and obligations under the shareholders’ agreement between the legal person you represent and the relevant Alleima company.

External recipients:

1. Other shareholders and representatives
2. Group companies

Storage period: Personal data is stored for this purpose as long as you are a shareholder.

Data controller: Alleima AB acts as the sole controller.

Inform and communicate with the shareholders about the business

Examples of what we do: We process your personal data to communicate with you as part of our day-to-day activities. We will also process your personal data to provide you with updates, such as press releases, financial reports and newsletters, about our business that we believe will be of interest for you as a shareholder.

Categories of personal data:

• Contact information
• Identity data
• Organisational data
• Shareholder information
• Communication data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest in communicating with you and provide you with news and updates on our business.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since it is information of relevance for you as a shareholder.

External recipients:

1. Other shareholders and representatives

Storage period: Personal data is stored for this purpose as long as you are a shareholder.

Please note that you may unsubscribe from newsletters at any time by clicking on the unsubscribe link avail-able in each communication, or by contacting us on the above contact details.

Data controller: Alleima EMEA AB and Alleima AB act as joint controllers.

Participate in procurements and similar activities

Examples of what we do: We process your personal data to participate in procurements and take necessary measures in connection with know your customer (KYC) procedures.

Categories of personal data:

• Contact information
• Identity data
• Organisational data
• Skills data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest in participating in procurements and similar activities.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since we otherwise would not be able to participate in crucial business-related activities.

External recipients:

1. Suppliers
2. Partners
3. Group companies

Storage period: Personal data is stored for this purpose during your board assignment.

Data controller: The Alleima company of which you are a board member acts as the sole controller.

Manage the business relationship with board members

Examples of what we do: We process your personal data to manage the relationship with you as a board member, for example to appoint board members, carry out board meetings, manage remuneration and expenses, document the business (such as information in minutes) and communicate with you as a board member.

Categories of personal data:

• Contact information
• Identity data
• Organisational data
• Picture, video and audio material
• Salary and remuneration data

Legal basis:

Performance of contract (Article 6.1 (b) of the GDPR). The processing of your personal data is necessary to fulfil our rights and obligations under the relevant board member agreement with you.

Legitimate interest (Article 6.1 (f) of the GDPR). If we have not entered into a board member agreement with you or if the activity is not strictly necessary to fulfil such agreement, the processing of your personal data is necessary to satisfy our legitimate interest in managing the business relationship with you.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since we otherwise would not be able to run our business properly.

Storage period: Personal data is stored for this purpose during the board assignment.

Personal data in business-related documents and contracts of key relevance for the relevant Alleima company are stored until further notice.

Board minutes are stored as long as they are necessary and relevant for the business in accordance with applicable laws.

Data controller: The Alleima company of which you are a board member acts as the sole controller.

Arrange and facilitate access to Alleima sites

Examples of what we do: We process your personal data to arrange and manage business-related travel and visits to Alleima premises. This includes, by way of example, organising transportation and accommodation and coordinating itineraries.

In addition, we process your personal data to manage and control physical access to our sites. This inter alia includes verifying the identity of visitors, issuing access cards and badges, maintaining visitor logs and applying other necessary safety, security and compliance procedures.

Categories of personal data:

• Identity data
• Organisational data
• Event data
• Communication data
• Picture material
• Travel and logistics data
• Demographic data
• Access and security data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of arranging and facilitating your access to Alleima sites.

Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, since we otherwise would not be able to assist you when travelling or granting you access to our premises.

Legal exemption:

Explicit consent (Article 9.2 (a) of the GDPR). The processing of special categories of personal data, for example information in health declarations or regarding disability or mobility needs, are based on your explicit consent.

External recipients:

1. Group companies
2. Travel and logistics partners

Storage period: Personal data is stored for this purpose until the business-related travel and visits have been carried out.

Some of your personal data will also be stored to fulfil our legal obligations (for example book-keeping requirements), see the processing activity fulfil our legal obligations below.

Moreover, access and security data (such as visitor logs), will be stored in accordance with our safety, security and compliance procedures.

Data controller: The relevant Alleima company arranging your visit to, or granting you access to, its premises acts as the sole controller of your personal data.

Manage incidents and damage claims

Examples of what we do: We process your personal data to manage, assess and record incidents and damage claims by you relating to our products and services. By way of example, this could be the case where an incident or injury has occurred during visits to our test and manufacturing facilities.

We will also process your personal to, where necessary, submit reports to insurance companies in case of accidents and to take other necessary measures as a result of an incident or a damage claim.

Categories of personal data:

• Identity data
• Organisational data
• Event data
• Communication data
• Payment data
• Information on damages and other health concerns

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of managing the incident and damage claim.

Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, since we otherwise would not be able to manage the incident and damage claim.

Legal exemption:

Establish, exercise and defend legal claims (Article 9.2 (f) of the GDPR). The processing of special categories of personal data, for example information on damages or other health conditions which you share with us, is necessary to establish, exercise and defend legal claims.

External recipients:

1. Group companies
2. Insurance companies

Storage period: Personal data is stored for this purpose for as long as necessary to assess and manage the specific incident or damage claim. Your personal data will also be stored for as long as necessary to comply applicable laws on incident record keeping.

Data controller: The Alleima company having a business relationship with the organisation that you represent or of which you are a contract person acts as the sole controller.

Carry out meetings, events and similar activities

Examples of what we do: We process your personal data to carry out meetings, events, trainings and similar activities, for example to register your participation, organise and administer the activity, communicate with you and other participants, and accommodate dietary preferences and meal requirements in connection with the activity.

Categories of personal data:

• Picture, video and audio material
• Communication data
• Contact information
• Identity data
• Organisational data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The use of your personal data is necessary to satisfy our legitimate interest of carrying out meetings, events and similar activities.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially if you have voluntarily signed up for or participates in the activity.

External recipients:

1. Partners
2. Group companies
3. Social media providers

Storage period: Personal data is stored for this purpose during the period the meeting, event or activity is carried out, and, where applicable, for a period thereafter as necessary to communicate with you and others about the activity.

Data controller: The relevant Alleima company carrying out the meeting, event or similar activity acts as the sole controller.

Follow up and evaluate activities carried out

Examples of what we do: If you have participated in an activity that we have carried out, for example a meeting, a demo, or an event, we process your personal data to follow up and evaluate the activity, for example to compile statistics of the number of participants and to plan for future activities.

Categories of personal data:

• Picture, video and audio material
• Communication data
• Contact information
• Identity data
• Organisational data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of following up and evaluating activities carried out.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since it concerns harmless personal data.

Storage period: Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice.

Data controller: The relevant Alleima company following up the activity acts as the sole controller.

Promote, educate and inform about our business, activities and values

Examples of what we do: We process your personal data to promote, educate and inform about our business, activities and values. This may include producing, editing and posting material, such as photos, videos and audio recordings of you in our internal and external channels, for example if you have participated in an event, exhibition or similar where Alleima has been present.

Depending on the situation, for example if the material is used to promote our business, the material may be posted on Alleima’s official social media and networking pages and websites.

Categories of personal data:

• Picture, video and audio material
• Communication data
• Contact information
• Identity data
• Organisational data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of promoting, educating and informing about our business, activities and values.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since you have the right to object to the processing.

Performance of contract, Article 6.1 b) of the GDPR. If you have entered into a specific contract for a relevant activity (for example a participation or model agreement), we process your personal data to perform that contract.

Consent, Article 6.1 a) of the GDPR. If any of the relevant activities require your consent, we will only process your personal data based on your freely given consent.

External recipients:

1. Group companies
2. Content marketing agencies and other partners
3. Social media networks

Storage period: Personal data is stored as long as necessary for the relevant purposes under this privacy notice.

Data controller: The relevant Alleima company promoting, educating, and providing information about the business, activities, and values acts as the sole controller.

Communicate in the course of the business

Examples of what we do: We process your personal data that you and others share with us in connection with internal and external communication in the course of the business, for example when our personnel communicate with each other and external persons via e-mail to carry out their work duties.

Categories of personal data:

• Picture, video and audio material
• Identity data
• Communication data
• Contact information
• Organisational data

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of communicating internally and externally in the course of the business.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since it concerns harmless data and data normally used for this purpose.

External recipients:

1. External persons that we interact with or who are included in the communication

Storage period: Personal data in communication is stored as long as necessary for the relevant purposes under this privacy notice.

Data controller: The Alleima company with which you communicate acts as the sole controller.

Investigations and audits

Examples of what we do: We process your personal data in connection with investigations, compliance activities and audits, for example for the purpose of monitoring and ensuring compliance with our guidelines, policies and procedures, including the Alleima Code of Conduct, as well as for investigating potential non-compliance, misconduct and suspected breaches of law.

We may also, where necessary, process your personal data as part of risk management, internal controls, and internal or external audits.

Categories of personal data:

• Identity data
• Communication data
• Contact information
• Organisational data

Other information relating to you as necessary to carry out the investigation or audit.

Legal basis:

Legitimate interest, Article 6.1 f) of the GDPR. Processing is necessary to fulfil our legitimate interest in dealing with investigations and for audit purposes.

Data relating to offences of a criminal nature is processed only where this is necessary for a legal claim to be established, enforced or defended in a specific case or, for example, to report a suspected crime to relevant law enforcement agencies.

External recipients:

1. Insurance companies
2. External advisors
3. Legal representatives
4. Public authorities, including courts and arbitration tribunals
5. Group companies

Storage period: Personal data is stored for this purpose as long as necessary to carry out the specific investigation or audit.

Data controller: Alleima AB acts as the sole controller.

Document the business

Examples of what we do: We process your personal data to document the business and activities relating to our business, for example in connection with company milestones, events, including personal data in legal documents and other material which we deem are of interest for the business to keep.

Categories of personal data:

Relevant categories of personal data as necessary for the purpose.

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of documenting the business.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose.

External recipients:

1. Group companies

Storage period: Personal data is stored for this purpose until further notice.

Data controller: The relevant Alleima company documenting its business activities acts as the sole controller.

Develop and improve the business

Examples of what we do: We process your personal data to develop and improve the business, including our services and products. By way of example, this includes to draft reports, analyses and compile statistics of various activities and events (such as sales, results and partnerships).

Categories of personal data:

Relevant categories of personal data as necessary for the purpose.

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of developing and improving the business.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose.

Storage period: Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice.

Data controller: The relevant Alleima company developing and improving the business. If another Alleima company is involved and they jointly decide how and why your personal data is processed for this purpose, that Alleima company and those companies act as joint controllers.

Manage sales and restructuring of all or parts of the business

Examples of what we do: If all or parts of the business would be sold, or in any other way transferred or restructured, we process your personal data where necessary for this purpose. Should the business be transferred to a buyer, your personal data would also be transferred and disclosed to the buyer. The buying company would in such case be responsible (data controller) for your personal data and the processing that takes place for the same purposes as stated in this privacy notice, unless you receive any other information in connection with the sale.

Categories of personal data:

Relevant categories of personal data as are necessary to manage the sale or restructuring of all or parts of the business in each case.

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of managing a sale or restructuring of all or parts of the business.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose if the buyer carries out the same or similar type of business that we do.

External recipients:

1. Buyers/investors
2. Potential buyers/investors
3. External advisors
4. Group companies
5. Public authorities

Storage period: Personal data is stored for this purpose for the period that is necessary to manage the sale or the restructuring.

Data controller: The relevant Alleima company managing the sale or restructuring acts as the sole controller.

Manage, defend and exercise legal claims

Examples of what we do: We process your personal data where necessary to manage, defend and exercise legal claims in an individual case, for example in connection with a dispute or a court proceeding.

Categories of personal data:

Relevant categories of personal data needed for managing and defending a legal claim in the individual case.

Legal basis:

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of managing, defending and exercising legal claims.

It is our assessment that our legitimate interest clearly outweighs your interest of not having your personal data processed for this purpose.

External recipients:

1. Counterparty
2. Courts
3. Debt collecting companies
4. External advisors
5. Insurance companies
6. Relevant authorities

Storage period: Personal data is stored for this purpose for the period as necessary to manage, defend and/or exercise the legal claims.

Data controller: The relevant Alleima company managing the legal claim acts as the sole controller.

Fulfil our legal obligations

Examples of what we do: We process your personal data where necessary to fulfil our legal obligations, for example accounting obligations and obligations under applicable data protection laws.

Categories of personal data:

Relevant categories of personal data that are necessary to fulfil the specific legal obligation.

Legal basis:

Fulfil legal obligation (Article 6.1 (c) of the GDPR). The use of your personal data is necessary to fulfil our legal obligations.

External recipients:

1. Relevant authorities

Storage period: Personal data is stored for such period that is necessary in order for us to fulfil the specific legal obligation.

Data controller: The relevant Alleima company subject to the legal obligation acts as the sole controller. If another Alleima company is involved and they jointly decide how and why your personal data is processed for this purpose, that Alleima company and those companies act as joint controllers.

Managing, securing and developing IT systems and services

Examples of what we do: We process your personal data for the purpose of managing, securing and developing our IT systems and services, for example when operating, testing, maintaining and developing such systems, troubleshooting, making backup copies, and managing system and application updates, changes and incidents.

We also process your personal data in connection with logging and monitoring the use of IT systems for operational, security and troubleshooting purposes, and managing IT incidents, for example in the event of system failures, cybersecurity incidents, data integrity issues, or attempted or actual attacks against our IT infrastructure.

Categories of personal data:

All categories of personal data that are stated in relation to the purposes of processing your personal data.

Legal basis:

Legitimate interest (Article 6.1 f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest in managing, securing and developing our systems and services.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose.

Storage period: Personal data is stored for the same period as stated in relation to each relevant purpose of the processing.

Data controller: Alleima EMEA AB acts as the sole controller. If another Alleima company is involved and they jointly decide how and why your personal data is processed for this purpose, that Alleima company and Alleima EMEA AB act as joint controllers.

Respond to legal requests

Examples of what we do: We process your personal data to respond to legal requests from authorities, for example law enforcement, tax authorities or any other authorities.

Categories of personal data:

All categories of personal data as necessary to respond to and evaluate the request in each case.

Legal basis:

Fulfil legal obligation (Article 6.1 (c) of the GDPR). The processing of your personal data is necessary to fulfil our legal obligations.

Legitimate interest (Article 6.1 f) of the GDPR). If there is no explicit legal obligation requiring that we respond to the legal request, but we consider that we and the public authority have a legitimate interest (which outweighs your privacy interest), we rely on this legitimate interest for the use of your personal data for this purpose.

External recipients:

1. Relevant authorities

Storage period: Personal data is stored for this purpose for the period that is necessary to respond to the specific legal request and thereafter for the period as necessary to document the request and our response to the request.

Data controller: The relevant Alleima company subject to the legal request acts as the sole controller. If another Alleima company is involved and they jointly decide how and why your personal data is processed for this purpose, that Alleima company and those companies act as joint controllers.