Politik for beskyttelse af personlige oplysninger

3.1. Providing our services

In order to provide our services, we process the personal data necessary for:

• administration of user accounts.
• provision of support.
• Issuance, renewal, transfer, or challenge of LEI codes.
• compliance with securities market rules.
• fulfilment of agreements with the Global Legal Entity Identifier Foundation (GLEIF) to maintain access to the Global Legal Entity Identifier System (GLEIS) such as the LOU.

3.2. Manage relationships with customers, suppliers, partners and GLEIF

If you are a contact person for a customer, supplier, partner or GLEIF, we process your personal data for the purpose of managing the customer or supplier relationship, cooperation, or our relationship with GLEIF and when necessary for follow-up and evaluation. Our handling is, for example:

• Registration of you as a contact person.
• Communication.
• Management and archiving of agreements.
• Administration of order confirmations and invoices.

3.3. Communicate about us and our business

We use your personal data to communicate about us and our business in various channels, for example through mailings before maintenance work in the customer portal or in marketing. You can unsubscribe from our marketing communications at any time by contacting us (privacy@nordlei.org).

3.4. Communicate internally and externally

In connection with communication, e.g., by e-mail, telephone, or other digital means, we may, where applicable, process your personal data. Communication takes place both between employees and with external persons.

3.5. Evaluate and develop our business

Where applicable, we may use your personal data to compile reports and statistics at an overall level and analyze these for the purpose of following up and evaluating the business. We also use these reports and statistics to develop and improve our business, business practices and strategies. When compiling these reports and statistics, anonymization/pseudonymization of personal data takes place. No profiling takes place within the framework of this processing.

For analyses carried out within the framework of data quality issues, we may use personal data such as organization number, company form, addresses, company signatory, board of directors, etc. When it comes to quality control, no anonymization of the data takes place. No profiling takes place within the framework of this processing.

3.6. Carry out our business

When we carry out our business, except in the provision of services, we use your personal data to:

• Document the business, e.g., to manage and save agreements, decision support, minutes, and presentations.
• Carry out recruitment processes or assess spontaneous applications, including reference contacts.
• Answer questions and provide customer service.
• Review the quality of our data.
• Detect and prevent misuse of our services, for your, others' and the service's safety.
• Ensure technical functionality and security, e.g., in security logging, error handling and backup.
• Manage and respond to legal claims, e.g., in connection with a dispute or legal process. For this purpose, we may share your information with other recipients, see more below.
• Comply with legal obligations, e.g., to comply with requirements of accounting or data protection legislation. For this purpose, we may share your information with other recipients, see more below.

1. 4.1. Customers

   In order to deliver the agreed service, personal data may be shared with our customers, for example during the verification process of LE-RD or in support cases.

2. 4.2. Data processors

   In our operations, we use service providers. These service providers provide, for example, IT services (e.g., storage) and communication services (e.g., communication in support), in which case personal data may be processed. When the service providers process personal data on our behalf, they are data processors to us. They may not use your personal data for their own purposes and are obliged by law and data processing agreement with us to protect your data.

3. 4.3. Companies that are data controllers for personal data
   1. 4.3.1. Government agencies (e.g., the Swedish Police, the Swedish Tax Agency)

      If we are required to do so by law or in case of suspicion of crime.

   2. 4.3.2. Payment service providers

      To administer payments via the website or customer portal, we use a payment service provider. We share and receive information from the payment service provider to enable you to pay for – and thus use – our services. In order to get paid, we may direct you to a third-party website that handles the payment. We are not responsible for the privacy processes of websites that we do not provide or operate. The payment service provider is the data controller/or processor for another controller, for its processing of your personal data. More information about their personal data management can be found at the payment service provider.

   3. 4.3.3. Group companies

      We may share personal data with other companies within our corporate group to achieve our business purposes and to market our services in accordance with applicable legislation.

   4. 4.3.4. Other

      In order to comply with our legal obligations, your personal data may be shared with our auditor, external advisors, and the Global Legal Entity Identifier Foundation (GLEIF) for registration in the Global Legal Entity Identifier System (GLEIS). In connection with a legal dispute, we may transfer data to other parties, such as external advisors, arbitration tribunals or counterparties. The processing is necessary to satisfy our legitimate interest in establishing, exercising and defending legal claims. We may also share information with potential buyers and sellers if we were to sell all or part of the business or in the event of a merger. The processing is necessary to satisfy our legitimate interest in carrying out the divestment or merger.

4. 4.4. Other recipients

   In recruitment processes, we may share your personal data with external parties, such as provided references.

6.1. Right of access (extract from the register), art. 15 GDPR

You have the right to request confirmation from us as to whether we are processing your personal data. If you want to get a deeper insight into what personal data we process about you, you can request access to the information. The information is provided in the form of a register extract stating the purpose, categories of personal data, categories of recipients, storage periods, information about where the information has been collected from and the existence of automated decision-making, and, where applicable, with the support of which safeguards transfer takes place to countries outside the EU/EEA.

The right to a copy of the register extract must not have a negative impact on the rights of others, including ours. If we make the assessment that your right to a copy of the register extract has a negative impact on the rights of others and we therefore exclude information from the copy, you will be informed of this and the reason why.

A request for an extract from the register must be made in writing and be signed in person. The request should be sent to Kungsgatan 56, 111 22 Stockholm. Please be aware that if we receive a request for access, we may ask for additional information to ensure effective handling of your request and that the information is provided to the right person.

6.2. Right to rectification, Art. 16 GDPR

If you believe that the information, we have about you is inaccurate or misleading, you have the right to request correction. Within the scope of the stated purpose, you also have the right to supplement any incomplete personal data. You can request correction by contacting us at privacy@nordlei.org. If you are logged in to our customer portal, you can change certain information yourself.

Please note that a historical information is not automatically considered incorrect, as it may have been correct at the time of registration.

6.3. Right to erasure, Art. 17 GDPR

You can request the deletion of personal data (the right to be forgotten) we process about you if:

• the data are no longer necessary for the purposes for which they have been collected or processed;
• You object to a balance of interests we have made based on legitimate interest and your reason for objection outweighs our legitimate interest;
• You object to processing for direct marketing purposes;
• The personal data is processed in an unlawful manner; or
• The personal data must be deleted in order to comply with a legal obligation to which we are subject.

We do not process any personal data of a child (under the age of 16) whose collection has taken place in connection with the provision of information society services (e.g., social media).

If you request deletion, we will review whether your request can be met. We have the right to deny your request if there are legal obligations that prevent us from immediately deleting certain personal data. These obligations come from, for example, accounting and tax legislation, banking, and money laundering legislation, but also from EU directives and regulations. Continued processing may also be necessary for us to be able to establish, exercise or defend legal claims. Should we be prevented from complying with a request for deletion, we will ensure that the processing of personal data is limited to only the purposes that prevent the requested deletion.

6.4. Right to restriction of processing, Art. 18 GDPR

You have the right, in certain cases, to request a restriction of our processing of your personal data. If you dispute that the personal data we process is correct, you can request limited processing for the time we need to check whether the personal data is correct. If we no longer need the personal data for the stated purposes, but you do need it to be able to establish, exercise or defend legal claims, you can request limited processing of the data from us. This means that you can request that we do not delete your data.

If you have objected to our balancing of interests for the processing of your personal data, you can request limited processing during the time we need to check whether our legitimate interests outweigh your interests in having the data deleted.

If the processing has been restricted in accordance with any of the situations above, we may only, in addition to the storage itself, process the data to establish, exercise or defend legal claims, to protect someone else's rights or if you have given your consent.

6.5. Right to data portability, art. 20 GDPR

You have the right to receive the personal data that you have provided to us and that concerns you in an electronic format that is widely used. You also have the right to transfer such data to another data controller (so-called data portability). A prerequisite for data portability is that the transfer is technically possible and can be automated. A further prerequisite for the right to data portability is that the processing takes place on the basis of your consent or to fulfill an agreement with you (Art. 6.1(a) and 6.1(b) GDPR respectively). In our detailed information you can see when we handle your personal data on the basis of consent or to fulfill an agreement with you.

6.6. Right to object to certain types of processing and direct marketing, Art. 21 GDPR

Some of our processing takes place with a balance of interests as a legal basis. You have the opportunity to object to these. If you make such an objection, we need to be able to show a legitimate reason for the processing in question that outweighs your interests, rights, or freedoms. Otherwise, we may only process the data to establish, exercise or defend legal claims.

You have the opportunity to object to your personal data being processed for direct marketing. The objection also covers the analyses of personal data (so-called profiling) carried out for direct marketing purposes. Direct marketing refers to all types of outreach marketing measures (e.g., by post, e-mail, and SMS). Marketing measures where you as a customer have actively chosen to use one of our services or otherwise sought us out to find out more about our services are not counted as direct marketing.

We do not carry out any so-called automated decision-making that produces legal consequences or otherwise significantly affects you.

6.7. Right to withdraw consent, art. 7 GDPR

When, where applicable, we base our processing of your personal data on your consent, you have the right to withdraw from this at any time. Such revocation may be limited to only part of the processing.

6.8. Right to lodge a complaint

In addition to the rights listed above, you also have the right to lodge a complaint with your relevant data protection authority. In Sweden, the Swedish Authority for Privacy Protection (IMY) is the supervisory authority. Their contact details can be found on www.imy.se. If you live or work in a country other than Sweden, you can turn to the privacy protection authority in that country. You can find your privacy protection authority here: Our Members | European Data Protection Board (europa.eu)