OUR PRIVACY POLICY IN BRIEF

Here at Hedin Mobility Group (”Hedin Mobility Group”, ”we”, ”our” and ”us”), we care about how your personal data is processed. Below is a brief summary of how we process your personal data as well as of your rights in relation to our processing of your data. You can read our integrity policy in full at https://hedinmobilitygroup.com/sv-se.

The companies within Hedin Mobility Group which you interact with are individually responsible for processing your personal data. For example, the company with which you enter into a contract when you purchase a vehicle is responsible for your personal data relating to your purchase.

In summary - When and why do we process your personal data?

When we make contact (such as by email, telephone, online chat or social media):

• to communicate with you when you have initiated contact with us, and
• to contact you regarding offers, to invite you to events or to give you a price quote for your vehicle at your request.

When you give your consent by visiting our homepage:

• to analyse how our website is used using a Google and Hotjar analysis tool as well as showing you tailored offers on other pages you visit using Google and Meta marketing services.

When you buy, lease or hire a vehicle or purchase a vehicle service or vehicle accessories from us or one of our dealers or when you make an online purchase:

• to complete your purchase, hire or lease,
• to communicate with you in connection with your order, e.g. send an order confirmation and follow up about your purchase after completion and send marketing materials to you,
• to remind you about items you have left in your basket online,
• to help you with any customer service cases or handle any guarantee, claim or right of withdrawal cases,
• to handle your customer account if you have chosen to create one, and to fulfil our legal obligations, e.g. storing information for accounting purposes.

When you subscribe to our newsletter:

• to send the newsletter with offers and information,
• to improve and develop our newsletter, and
• to ensure that you don’t receive marketing from us if you have opted out.

When you represent one of our dealers, suppliers or partners or a potential member of one of these groups:

• to communicate with you as well
• as to conclude and fulfil agreements with the companies you represent.

When you participate in one of our events:

• to process your application to the event, implement the event and follow up on your participation and our contact, and
• to take photographs during our event as well as promote other events using photographs in which you may appear.

We share your personal data with other parties, including companies within the Hedin Mobility Group, our dealers, general agents and vehicle manufacturers as well as IT suppliers. Your personal data will be shared outside the UK via our use of certain IT suppliers as well as your use of our website where you consent to our use of Google, Meta and Hotjar.

Your rights

Your rights in brief:

• The right to complain to the UK Information Commissioner’s Office
• The right to withdraw consent
• The right of access
• The right to object
• The right to erasure
• The right to data portability
• The right to rectification and
• The right to restrict processing

Contact

If you have any questions regarding our processing of your personal data or if you wish to exercise any of your rights, please contact us by email datacompliance@hedinautomotive.co.uk

If you wish only to withdraw consent to receiving marketing communications, please contact us by email unsubscribe@hedinautomotive.co.uk

OUR PRIVACY POLICY IN FULL

Hedin Mobility Group (”Hedin Mobility Group”, “we”, ”our” and ”us”) safeguards your privacy. This privacy policy informs you about how we process you personal data as well as which rights you have in relation to our processing of your personal data.

This privacy policy is valid if you have contact with us in some way; use our social media; purchase, lease or hire a vehicle; purchase a vehicle service or accessories from us; or make a purchase via or visit one of the group’s websites e.g. https://www.hedinbil.se/ or https://hedinmobilitygroup.com/sv-se/.

If you have any questions regarding our processing of your personal data or you wish to exercise any of your rights you are welcome to contact us. You can find our contact details below.

In brief: How do we process your personal data?

If we are in contact or you use our social media we process your personal data to:

• communicate with you, and
• contact you with offers.

If you visit our website we process your personal data to:

• analyse how our website is used, and
• show you tailored offers on other websites you visit.

If you make an online purchase or if you purchase, lease or hire a vehicle or purchasea vehicle service or accessories from us or one of our dealers we process your personal data to:

• complete your purchase, hire or lease
• communicate with you in connection with your order, e.g. send an order confirmation and follow up on e.g. your purchase after completion
• send marketing,
• help you with any customer service cases,
• handle your customer account if you have chosen to create one, and
• fulfil our legal obligations, e.g. storing information for accounting purposes.

If you have subscribed to our newsletter we process your personal data so that you receive our newsletter or to ensure that you don’t receive marketing form us if you have opted out.

If you represent one of our dealers, suppliers or partners or a potential member of one ofthese groups we process your personal data to communicate with you and conclude agreements with the company you represent.

If you participate in one of our events we process your personal data to manage your registration for the event, carry out the event, follow up on our contact and promote other events using photographs which we take during our event in which you may appear.

Your rights

A more detailed description of which rights you have in relation to our processing of your personal data can be found below. Your rights in brief:

• The right to complain to the UK Information Commissioner’s Office
• The right to withdraw consent
• The right of access
• The right to object
• The right to erasure
• The right to data portability
• The right to rectification and
• The right to restrict processing

Contact us

If you have any questions regarding our processing of your personal data or if you wish to exercise any of your rights, please contact us by email datacompliance@hedinautomotive.co.uk

Contents

Who is responsible for processing your personal data?

Who has access to your personal data and why?

Is your personal data shared outside of the UK?

Detailed description of personal data processing

If you make contact with us, chat with us or use our social media

If you visit our website

If you make a purchase on our online store

If you have an account with our online store

If you buy, hire or lease a vehicle, buy a vehicle service or accessories from us

When you subscribe to our newsletter

If you have asked us to stop sending marketing to you

If you act in the capacity of a representative for our suppliers,

dealers or partners, or a potential one of these

When you participate in one of our events

To be able to meet our legal obligations and handle claims

Balance of interests

What are your rights when we process you personal data? - Detailed description

Who is responsible for processing your personal data?

Hedin Mobility Group AB, corporate identification number 556065–4070, acting as the personal data controller, is responsible for processing your personal data when you visit our website or interact with us on our social media.

If you purchase something from our online store, Hedin e-commerce AB, corporate identification number 559231-7639 is responsible for processing your personal data.

When you interact with us in another manner, the company within the Hedin Mobility Group with which you interact is responsible for processing your personal data. For example, the company with which you enter into a contract when you purchase a vehicle is responsible for your personal data relating

to your purchase.

If you have any questions regarding our processing of your personal data or if you wish to exercise any of your rights, please contact us by email datacompliance@hedinautomotive.co.uk.

The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as below. Please see the section headed “Detailed description of personal data processing” for further information.

• Identity Data includes first name, maiden name, last name, username or similar identifier, [marital status, title, date of birth and gender].
• Contact Data includes billing address, delivery address, email address and telephone numbers.
• Financial Data includes [bank account and payment card details].
• Transaction Data includes [details about payments to and from you and other details of products and services you have purchased from us].
• Technical Data includes [internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website].
• Profile Data includes [your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses].
• Usage Data includes [information about how you use our website, products and services].
• Marketing and Communications Data includes [your preferences in receiving marketing from us and our third parties and your communication preferences].

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

IF YOU FAIL TO PROVIDE PERSONAL DATA

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

Who has access to your personal data and why?

Your personal data is processed primarily by Hedin Mobility Group. We share your personal data with:

• companies within Hedin Mobility Group;

• our IT suppliers who process personal data on our behalf as our personal data processor to ensure that we have a functioning IT system and that our operations run effectively;
• our dealers, general agents and/or vehicle manufacturers if you are our customer so we can send customer research, follow up on your purchase and send relevant marketing;
• finance companies we work with if you have opted for financing for your purchase from us;
• insurance companies we work with if you have opted for insurance for your purchase from us or if it is necessary for repairs, for example:
• our payment service provider to administer your payment if you purchase from our online store. If your choose to pay by invoice, Our payment service provider can share your personal data with credit reference agencies to assess your financial circumstances;
• our delivery and packing services process your personal data to ship parcels and manage any returns when you purchase from our online store;
• our customer service providers and chat providers on our website;
• external partners who help us to administer our marketing;
• Google and Meta who provide the digital channels we use to provide you and other potential customers with tailored marketing; and
• Google and Hotjar which analyse the use of our website and therefore have access to your personal data if you use our website.

For more information on how we share your personal data please contact us using the contact details provided at the start of this privacy policy.

Is your personal data shared outside of the UK?

We share your personal data with the Hedin Mobility Group, this will involve transferring your data outside the UK. Many of our external third parties are based outside the UK so their processing of your personal data will involve a transfer of data outside the UK. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.
• Where we use certain service providers, we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK.

As a general rule, we and the bodies with which we share your personal data process your personal data only within the EU/EEA. The following exceptions apply, however:

• When you use our website or make a purchase from our online store, we use Google, Meta and Hotjar services to improve our services. Your personal data is transferred to the USA if you give consent for this personal data processing. We have anonymised personal data as much as possible to avoid your personal data being processed outside of the UK.
• In certain cases, it is necessary for our contracted IT service providers to process and transfer your personal data outside of the UK according to our instructions.
• Where we need to perform the contract we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation.

Our IT service providers, Google, Meta and Hotjar use standard agreement clauses when transferring personal data outside of the UK. The IT service providers, Google, Meta and Hotjar have multiple security measures so that as far as possible, when transferred, your personal data is protected to the same extent as it is within the UK..

If you have any questions regarding how we share your personal data, e.g. about the legal basis we have to share it, or if you would like a copy of the appropriate security measures we have taken, please contact us using the contact details provided above.

Detailed description of personal data processing

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation.

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below. If you make contact with us, chat with us or use our social media

When you make contact with us, e.g. via our chat or social media, we will process your personal data as described in the tables below. We collect your personal data directly from you when you make contact with us. If you use our social media, we process the personal data we have collected directly from you and which is found on the social media we use. In certain cases, we make contact with you to provide you with relevant marketing and in such cases, we may have collected your data from a third party.

If you use social media, the platform you use (e.g. Instagram) will also process your personal data and we therefore recommend that you read our information in the table below along with the information found on the social media platforms.

If you visit our website

We analyse how the website is used and show you relevant offers on other sites you visit based on this analysis. This is explained in detail in the table below.

We collect your personal data from your device when you visit our website and from our partners Google and Meta who use the information they already have to show you a tailored offer from us.

To be able to collect personal data for analysis and promotions we use cookies and other similar technology as below. Our information text about cookies explains in more detail how this happens. More information about cookies can be found here.

Profiling: We use an automated decision maker, so-called profiling, to show you promotions which we believe are best suited to you and to provide tailored marketing. Profiling is carried out as otherwise we couldn’t show or send you promotions and marketing which are relevant to you. Without this profiling you would see promotions which are not relevant to you. You have the right to object to profiling. Read more about your right to object to profiling in our processing of your personal data in the section below which is about your rights.

If you make a purchase on our online store

We process your personal data in connection with your visit and/or purchase on our online store. We collect your personal data from you when you make your purchase or provide us with your personal data in another way. The payment service provider we use can also use your personal data that they have previously stored. You can read more about this in the information the payment service provider has given you.

If you have an account with our online store

If you buy, hire or lease a vehicle, buy a vehicle service or accessories from us

The table below describes how we process your personal data if you make a purchase with us or one of our dealers. We collect your personal data directly from you. We also collect necessary data about you and your vehicle from the UK Driver and Vehicle Licensing Agency.

When you subscribe to our newsletter

This table describes how we process your personal data if you have chosen to subscribe to our newsletter. We collect personal data partly directly from you and partly via our analysis of how you use our newsletter.

If you have asked us to stop sending marketing to you

How we process your personal data if you have deregistered from our marketing is described below. We collect your personal data directly from you.

If you act in the capacity of a representative for our suppliers, dealers or partners, or a potential one of these

How we process your personal data if you represent a company which we already have an agreement with is described below. We collect your personal data directly from you or the company you represent.

When you participate in one of our events

The table below describes how we process your personal data if you participate in one of our events. We collect your personal data directly from you.

To be able to meet our legal obligations and handle claims

Balance of interests

As indicated above, we process some of your personal data on the basis of balancing interests as a lawful basis for the processing. Balancing of interests means that we have assessed that our legitimate interest in carrying out the processing outweighs your interest and your fundamental rights not to have your personal data processed. What constitutes our legitimate interest is set out in the tables above.

If you wish to know more about how we have made these assessments, please contact us. Our contact details can be found at the start of this privacy policy.

Disclosures of your personal data

We may share your personal data with the parties detailed below for the purposes outlined in the tables set out at “Detailed description of personal data processing” above.

• Other companies in the Hedin Mobility Group [acting as joint controllers or processors] and who are based in Sweden and provide [IT and system administration services].
• Service providers [acting as processors] based in Sweden who provide [IT and system administration] services.
• Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors and insurers based in [the UK and EU/EEA] who provide [consultancy, banking, legal, insurance and accounting services].
• HM Revenue & Customs, regulators and other authorities [acting as processors or joint controllers] based [in the UK] [who require reporting of processing activities in certain circumstances].
• Specific third parties such as Google, Hotjar and Meta.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

How long will you use my personal data for?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Details of retention periods for different aspects of your personal data are outlined in the tables set out at “Detailed description of personal data processing” above.

What are your rights when we process your personal data? - Detailed description

In accordance with data protection legislation, you have certain rights in relation to our processing of your personal data. If you have any questions about our processing or you want to exercise any of your rights, please contact us using the contact details above. More detailed information about your rights can be found below.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Right to complain to the UK Information Commissioner’s Office)

You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK regulator for data protection issues, if you believe that the processing of your personal data is in breach of GDPR. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Right to withdraw consent

You have the right to withdraw your consent at any time. Withdrawing your consent does not affect the legality of processing which required your consent prior to its being withdrawn.

Right of access

You have the right to receive confirmation as to whether or not we are processing your personal data. You can send a request by contacting us. If we process your personal data, you also have the right to receive a copy of the personal data we process and information about the processing.

In detail: The information to which we give you access in such cases is:

• the purposes of the processing;
• the categories of personal data to be processed;
• the recipients or categories of recipients to whom the personal data have been or are to be disclosed, in particular recipients in third countries or international organisations;
• where possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period;
• the existence of the right to request us to rectify or erase personal data or to restrict or object to the processing of personal data relating to you;
• the right to lodge a complaint with a supervisory authority;
• if we do not collect your data, any available information about where that data came from;
• the existence of automated decision-making, including profiling, where you also have the right to receive meaningful information about the reasoning behind, significance of and envisaged consequences of such processing; and
• if the personal data is transferred to a third country or to an international organisation, you also have the right to be informed of the appropriate safeguards put in place during the transfer

You have the right to obtain a copy of the personal data processed by us. For any additional copies you request, we may charge a reasonable fee based on our administrative costs. If you have requested the information by electronic means, you will receive the information in a commonly used electronic format, unless you request otherwise.

Your right to request copies as described above shall not adversely affect the rights and freedoms of others.

If you have any questions regarding our processing of your personal data or if you wish to exercise any of your rights, please contact us by email datacompliance@hedinautomotive.co.uk

Right to object

You have the right to object at any time to the processing of personal data relating to the personal data that we process.

In detail: Your right to object is as follows:

• You have the right to object at any time on grounds relating to your specific situation regarding the processing of your personal data, which includes profiling based on these provisions. If you object, we may no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or if this is for the purpose of the establishment, exercise or defence of legal claims. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, which includes profiling where the profiling is related to direct marketing. If you object to processing for direct marketing purposes, you have an unconditional right to have the processing of your personal data for such purposes stopped.
• Regarding the use of information society services, you have the right to object in an automated way using technical specifications.

Right to erasure ("right to be forgotten")

You have the right to have your personal data deleted by us without undue delay.

In detail: We are obliged to erase personal data without undue delay if any of the following applies:

• the personal data are no longer necessary for the purposes for which they were collected or processed;
• you withdraw your consent on which the processing is based and there is no other legal basis for the processing;
• you object to the processing and there are no overriding legitimate grounds for the processing, or you object to the processing;
• personal data have been processed unlawfully;
• the personal data must be erased in order to comply with a legal obligation under Union or Member State law to which we are subject; or: If we have published your personal data and in accordance with the above are obliged to erase your data, we will take reasonable steps, taking into account available technology and the cost of implementation, to notify other personal data controllers processing the personal data that you have requested them to erase any links to, or copies or reproductions of that personal data.

We will notify each recipient to whom personal data has been disclosed of any erasure that has taken place as described above, unless this proves impossible or involves a disproportionate effort. If you would like information about these recipients, please contact us.

Please note that our obligation to erase as described above does not apply to the extent that processing is necessary for the following reasons:

• to exercise the right to freedom of expression and information.
  
• to comply with a legal obligation which requires processing under Union law or under the national law of a Member State to which we are subject,
• in order to establish, exercise or defend legal claims.

Right to data portability

You have the right to receive your personal data from us in a structured, commonly used and machine- readable forma You also have the right for your personal data to be transferred to a different personal data controller if this is technologically possible (“data portability”).

In detail: The right to data portability applies to personal data that you have provided to us in a structured, commonly used and machine-readable format if:

• the processing is based on the lawful ground of consent, or performance of a contract; and
• the processing is automated.
• Your right to data portability is without prejudice to your right to erasure.
• Your right to data portability must not adversely affect the rights and freedoms of others.

Right to rectification

You have the right to have inaccurate personal data concerning you rectified without undue delay. Taking into account the purpose of our processing of your personal data, you also have the right to complete incomplete personal data, including by providing a supplementary statement.

In detail: We will notify each recipient to whom personal data has been disclosed of any rectification that has taken place, unless this proves impossible or involves a disproportionate effort. If you would like information about these recipients, please contact us.

Right to restrict processing

You have the right to request that the processing of your personal data be restricted.

In detail: Your right applies if:

• you dispute the accuracy of the data (but only for a period of time that allows us to verify this);
• the processing is unlawful and you object to the erasure of the personal data and instead request a restriction on the use of the data;
• you need the personal data to establish, exercise or defend legal claims even though we no longer need the personal data for our purpose of processing; or
• you have objected to the processing pending verification of whether the legitimate interests of the personal data controller outweigh the legitimate interests of the data subject.

Where the processing referred to above has been restricted, such personal data, with the exception of storage, may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of substantial public interest of the Union or of a Member State. We will notify you before the restriction of processing ends.

We will notify each recipient to whom the personal data has been disclosed of any restriction of processing that has taken place as described above, unless this proves impossible or involves a disproportionate effort. If you would like information about these recipients, please contact us.