Data protection

1.    Introduction

The purpose of this privacy notice is to provide information on how Cementa AB, (“Cementa” or “we”) process and use the personal data collected from you in connection with your visit on this website and your use of the website’s functions.

Cementa, which is a company within Heidelberg Materials, respects your privacy and the protection of your personal data. All processing of personal data is carried out in accordance with the European Union’s General Data Protection Regulation (the “GDPR”). This privacy notice also contains information on how you can contact us with questions about our processing of your personal data.

2.    Purpose and legal basis for the processing of your personal data

Below is a description of what personal data we process about you, for which purposes we process your personal data and which legal bases we base our processing of your personal data on.

•    To answer your requests

(i)    What personal data being processed and why?

To answer requests from you, we process your name, e-mail address and phone number as well as other personal data that you may leave in connection with your request.

(ii)    What is the legal basis for the processing?

The processing of your personal data for this purpose is based on our legitimate interest to provide you with good service and to be able to answer your request. When you contact us with a request, it is also in your interest that we process your personal data in order to provide you with the information and service that you have requested. Furthermore, the personal data we process in connection with your request is of non-sensitive character and is necessary for us to be able to satisfy and answer your request. Personal data is only shared with third parties if it is required to answer your request.

•    To contact you for marketing purposes and as part of our follow-up of customer relations

(i)    What personal data is being processed and why?

To contact you for marketing purposes and as part of our follow-up of customer relations, we process your name and e-mail address.

(i)    What is the legal basis for the processing?

The processing of your personal data for this purpose is based on our legitimate interest of marketing our business and maintaining a good relation with you as a customer or representative of a corporate customer. Marketing is a fundamental part of our business and we always strive to provide marketing that is relevant to you. It is also in our interest to maintain, manage and grow the relationship we have with you (or the company you represent) as a customer.

•    To manage and improve this website, for our internal information gathering and for statistical analysis

(i)    What personal data is being processed and why?

We process personal data collected using cookies. For further information about which cookies we use and what information they collect, see our Cookie policy.

(ii)    What is the legal basis for the processing?

The processing of personal data through the use of so-called necessary cookies is necessary for us to fulfil the agreement with you regarding the use of our website, i.e. without the processing of such cookies we cannot provide you with a functioning website. Processing of personal data collected using other types of cookies is based on your explicit consent. For more information, see our Cookie policy.

3.    Who has access to your personal data?

We have taken appropriate technical and organisational security measures to protect your personal data against loss, unintentional and unauthorized access and unauthorized disclosure. The number of persons that have access to your personal data is limited. Only persons at Cementa that needs to process your personal data in accordance with the purposes stated above have access to the personal data.

We may share your personal data with other companies within the HeidelbergCement Group if required to fulfil the purposes mentioned above. Such HeidelbergCement companies may be located within or outside the EU/EEA.

We may also share your personal data with third parties under the following scenarios:

• When required by law;
• to Cementa’s service providers which perform services on our behalf in connection with this website and its functions (for example, our IT services provider that provides, develops and supports the website). Your personal data will only be shared with such service providers to the extent necessary to provide this website; and
• to a buyer or a potential buyer of our business.

Cementa will take measures to protect all personal data transferred to such third party.

Your personal data may be transferred to countries that might have a lower level of protection of personal data than that offered within the EU/EEA. When your personal data is transferred to countries outside the EU/EEA, we use standard contractual clauses that have been approved by the European Commission to ensure an adequate level of protection for your personal data. The standard contractual clauses are available via the following link:  Standard Contractual Clauses (SCC) (europa.eu)

4.    For how long do we store your personal data?

We store your personal data for as long as is necessary to fulfil the purpose for which it was collected. This means that we store your personal data in accordance with the table below. Statistics that have been anonymised and no longer can be attributed to you may be stored for a longer period of time.

5.    What are your rights?

Cementa AB with organisation number 556013-5864 is the data controller of the processing of your personal data described in this privacy notice. This means that we are responsible for ensuring that your personal data is processed correctly and in accordance with applicable laws. Read more about your rights below.

• The right of access: You have the right to know which personal data we process about you, for what purposes the personal data is processed and who we share personal data with, etc. You also have the right to access the personal data and request a copy of the personal data being processed.
• The right to rectification: If you notice that we have incorrect or incomplete personal data about you, you can always request that we correct or supplement this personal data.
• The right to erasure and restriction: In some cases, you may request that we delete your personal data or that we limit our processing for a certain period of time. Please note that limiting or deleting your personal data may result in e.g. us not being able to provide you with the products you have purchased.
• The right to object: You have the right to object to the processing we perform based on our legitimate interest.
• The right to data portability: In cases where we base our processing on your consent or on the fulfilment of an agreement, you also have the right to receive your personal data in a structured, commonly-used and machine-readable format and have the personal data transferred to another controller.
• Withdrawal of consent: If you have given your consent to processing of your personal data, you always have the opportunity to withdraw your consent by contacting us using the contact information below.

If you have any questions about our processing of your personal data, you can contact us by e-mail at info@cementa.se or by sending a letter to Box 47210, 100 74 Stockholm, in an envelope marked ”Att: Data Protection Line Manager”. If you have any objections or complaints regarding how we process your personal data, you also have the right to contact or file a complaint with the Swedish Data Protection Authority.

6.    Cookies

When you visit our website, we may collect and/or store information about your visit to manage and improve this website, for our internal information gathering and for statistical analysis by placing cookies. Cookies are small text files that a website or its service provider transfer to your computer’s hard drive through your browser. Cookies enable us to recognize your browser and to access and store certain information.
For further information on how we use cookies on our website, please read our Cookie policy.

7.    Changes

If any changes are made concerning the processing of your personal data, we will inform you of the changes by publishing an updated version of this privacy notice on Cementa’s website: www.cementa.se.

• Read our cookie policy here.

1.    Introduction

The purpose of this privacy notice is to provide information on how Heidelberg Materials Sweden AB, org. nr 556000-6057 together with Heidelberg Materials Ballast Sverige AB, org. nr 556016-1183, Heidelberg Materials Betong Sverige AB, org. nr 556188-3892 and Heidelberg Materials Cement Sverige AB, org. nr 556013-5864 (together ”HM” or ”we”), as joint controllers processes your personal data in connection with the use of E-Mail Protection System (”EMPS”). The joint responsibility for the processing of personal data is based on our collaboration relating to the implementation and use of EMPS as a tool for reviewing certain e-mails for the purposes listed below.

We respect your privacy and duly protect the personal data we process about you. All processing of personal data is carried out in accordance with the European Union’s General Data Protection Regulation (the “GDPR”). The following describes how we collect, process and share your personal data.

2.    How does EMPS work?

EMPS is a system within HM which monitors emails sent to or from carefully selected employees whose professional role may present increased risks from a competition law perspective (”Affected Employees”). The Affected Employees are employees who work within HM’s management and employees who work within the marketing and sales departments. Through EMPS, a filter is installed in the email software Microsoft Outlook which scans the incoming and outgoing emails with the exception of emails that have been marked as private and emails to and from certain sensitive senders and recipients such as employee representatives, data protection officers, legal counsel, certain HR representatives and employees within Legal and Compliance Northern Europe. If necessary, Mannheimer Swartling Adovokatbyrå may be asked to provide assistance with the review.

If an email contains a pre-defined keyword or a certain domain name (and is not exempt from EMPS) the email will be copied and sent to certain dedicated inboxes. The email will subsequently be reviewed by the group-wide function Legal and Compliance Northern Europe, in order to determine if the email contains improper wording or correspondence that suggests a lack of awareness of what is allowed pursuant to HM’s internal policies, regulatory documents and/or competition law. 

3.    What personal data do we process about you?

We collect personal data directly from you or from other parties that enter your personal data in email correspondence. The personal data that will be processed through EMPS is mainly personal data that frequently appear in work-related email correspondence, such as name, address, phone number, title, place of employment and other information included by the sender.

Emails may be viewed as blank text fields where the sender may choose to include personal data that normally does not appear in work-related email correspondence.  Therefore, we are unable to provide an exhaustive enumeration of the categories of personal data that may be processed by HM through EMPS.

4.    For what purpose is the personal data processed?

The described processing activities will enable HM to identify potential deficiencies in Affected Employees’ knowledge of what is allowed according to competition law, and identify potential breaches of competition law at an early stage. This gives HM the opportunity to take appropriate actions to prevent future breaches by improving our employee’s knowledge through specialized training efforts as well as rectifying potential breaches of competition law. The processing carried out via EMPS also benefits many of the data subjects in that, as a result of the e-mail review, they are less likely to commit breaches of competition law which decreases the risk for  being subject to extensive internal- or authority investigations.

5.    What are the legal grounds for processing of personal data?

The processing is based on HM’s legitimate interest in increasing the internal knowledge level relating to, and to prevent breaches of, competition law. HM has carried out and documented a balancing test, where we have weighed our interest in performing the processing activities against the data subjects’ interest in not having their personal data processed. 
We consider that our interest in performing the processing activities outweighs the interests of the data subjects’ in not having their personal data processed. Please contact us using the contact information provided in Section 8 below if you would like access the complete balancing test performed to reach this conclusion.

6.    How long is the personal data stored?

All emails sent or received by an Affected Employee, with the exception of private or otherwise excluded e-mails) will be scanned through EMPS. Only emails containing any of the predefined keywords or domain names will be copied and sent to certain dedicated inboxes for review. Emails that do not contain any of the keywords or domain names will be deleted without further review.

• Emails that are sent for review but which do not indicate a lack of understanding of what is allowed according to internal rules and/or competition law will be deleted from the inbox directly after review.
• Emails that are sent for review which indicate a lack of understanding of what is allowed according to internal rules and/or competition law will be printed and then deleted from the inbox in EMPS. The printout will be saved for as long as the indication concerning the lack of understanding of rules remains and during the following review. It will then be destroyed.
• Emails that are sent for review but are not reviewed within 14 days will be automatically deleted from the inbox in EMPS.

In addition to the personal data processing carried out through EMPS, HM are continuously creating backup copies of our entire IT system, which includes all emails that have been sent or received by HM employees. These backup copies are downloaded to a magnetic tape where they are stored for 10 years. The backup copies are saved in order for us to be able to restore the entire IT system after unlawful access, extensive hardware failure or accidents (such as fire or flooding).

7.    Who has access to your personal data?

We have implemented appropriate technical and organisational measures to protect your personal data against loss, accidental and unlawful access and unauthorised disclosure. The number of persons with access to your personal data is limited. Only a few individuals within Legal Compliance Northern Europe will be given access to the emails that have been scanned by EMPS and sent for further review. However, if necessary, Mannheimer Swartling Adovokatbyrå may be asked to provide assistance with the review. Furthermore, the IT department may be given access to the personal data. The IT department will not process the personal data on a regular basis, but only to the extent required for potential support and service.

We will be sharing your personal data with the two companies within the Heidelberg Materials group listed below:

• Heidelberg Materials AG as system owner of EMPS and data processor for the personal data processing described above, and
• Global IT Center s.o.r. as sub-processor to Heidelberg Materials AG for the personal data processing described above.

We may also share your personal data with suppliers and partners that carry out services on our behalf or in other ways collaborate with us to ensure IT functionality, such as Microsoft who provides the software program Outlook.

8.    What are your rights?

Heidelberg Materials Sweden AB, Heidelberg Materials Ballast Sverige AB, Heidelberg Materials Betong Sverige AB, and Heidelberg Materials Cement Sverige AB are joint data controller for the processing of your data. This means that we are jointly responsible for your personal data being processed correctly and in accordance with applicable laws. Read more about your rights below.

• Right to access: You are entitled to know what personal data we are processing about you, for which purposes we are processing the personal data and who we share your personal data with, etc. You also have the right to gain access to the personal data and request a copy of such data.
• Right to rectification: If you notice that we have incorrect or incomplete personal data about you, you can always request that we correct or complete such personal data.
• Right to erasure and restriction: In some cases, you may request that we delete your personal data or that we restrict our processing for a certain period of time. Please note that deletion or restriction of your personal data may result in us not being able to fulfil our obligations under our employment agreement or receive emails from you.
• Right to object: In certain cases, you have the right to object to the processing, for example you may object to the processing that we perform based on our legitimate interest.
• Right to data portability: In cases when we base our processing on your consent or the fulfilment of an agreement with you, you are entitled to extract your personal data in a structured, commonly used and machine-readable format and to transfer the personal data to another controller.

If you have questions regarding how we process your personal data, you are most welcome to contact Heidelberg Materials Sweden AB who has been chosen as the common point of contact concerning the personal data processing that we jointly perform through EMPS by sending an email to victor.ask@heidelbergmaterials.com or by mail to Marieviksgatan 25, Box 47055, 100 74 Stockholm, Sweden.

If you have any objections or complaints about the way we process your personal data, you have the right to file a complaint with the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten).

9.    Changes

If any changes are made concerning the processing of your personal data, we will inform you of such changes by publishing an updated version of this privacy notice on this website. If you are employed by us, you will also be able to access the updated version of this information text on our intranet.