PRIVACY POLICY

NorthTracker respects your privacy and is committed to protecting your personal data. This privacy policy provides information on how we collect, process and share your personal data when you use our products and services, visit our website, subscribe to our newsletter, communicate and interact with us. It also provides information about your rights to protect your privacy.

1. Who is the data controller?

The data controller for processing in accordance with this privacy policy is NorthTracker AB, reg. no. 566826-4674, Gustavslundsvägen 139, 167 51 Bromma. If you have any questions regarding this privacy policy or the processing of your personal data, you are welcome to contact us by e-mail at dataskydd@northtracker.com.   

For personal data collected to fulfil agreements with our customers, it is often the customer itself that has control over the data we process and thus the customer itself is the data controller. NorthTracker then acts as a data processor to the customer and in these cases a data processing agreement is entered into between the customer and NorthTracker.

2. Data we collect and how we collect it

We may collect, use, store and transfer different types of personal data. Below we describe the types of personal data we collect and how we collect it.

Contact details

Name, social security number, telephone number, e-mail address and postal address of customer, partner and supplier, details of any contact person (name, e-mail address and telephone number) and payment/invoice information.

Transaction data

Data from contracts we have concluded, about products and services you have bought from us and data about payments to and from you.

User data

Data generated automatically when using our services, such as GPS location, dates and times of journey start and stop and journey data including start and stop addresses/coordinates, current speeds and direction, duration, distance, engine status (on or off) as well as raw accelerometer data used to create driving scores and identify events such as heavy acceleration, hard braking, tight turns or idling.

Data that the customer is able to provide when using our services, such as vehicle information, leasing information, insurance information and service information. Vehicle information may include registration number, make and model, first registration date, emission information, category, colour, name, vehicle type and fuel type as well as vehicle group, assigned driver, original and updated odometer reading. Lease information may include leasing company, contract number, start date of the contract, mileage limit, duration of the contract, as well as readings at the beginning of the lease period. Insurance information may include insurance company, policy number, start date, mileage limit, duration of the contract, and mileage at the start of the policy. Service data may include last service date, meter reading at last service, service interval based on distance or time, and contact information for service managers. In addition, hardware diagnostic data such as GPS satellites, mounting angle and opening hours can be included.

Technical data

IP address, your login details, browser type and version, time zone setting and location, browser plug-ins and versions, operating system and platform and other technologies on the devices you use to access our website, and information about how you use and interact with our website.

When you interact with our website or services, we may automatically collect technical data about your equipment, browsing behaviour and patterns. We collect this data using cookies and similar technologies. We may also collect technical data about you if you visit other websites or social media using our cookies. We will only use cookies - with the exception of strictly necessary cookies - if you have given your consent.

Marketing & communication data

Information about your preferences for receiving advertising from us or our partners and your communication preferences. After you have been in contact with NorthTracker, we may ask you about your experience through a customer survey. By participating in the customer survey, you help us to improve our products and services. If you do not wish to share this type of information with us, you do not need to participate in the customer survey.

Recruitment data
If you apply for a position with NorthTracker, we will collect and process information from your application, CV, certificates and references, as well as personal data such as name, email address and phone number.

3. Purpose and legal basis

We will only use your personal data if there is a legal basis for it under current data protection legislation ("GDPR"). Usually we use your personal data:

a) if we need it to fulfil a contract we intend to conclude or have concluded with you under Article 6(1b) GDPR;

b) if we need it to fulfil a legal obligation under Article 6(1c) GDPR;

(c) where you have given your consent under Article 6(1a); or

d) where it is necessary to protect our (or third parties') legitimate interests and your interests and fundamental rights do not override those interests under Article 6(1)(f) GDPR.

Below we have described the contexts in which we intend to use your personal data and the legal basis we rely on as well as our legitimate interests.

To the extent that we refer to our legitimate interest as a legal basis, we have carried out a balancing exercise between our interests and needs to process the data and your interest in the protection of your personal data. Please contact us by email at dataskydd@northtracker.com if you want more information on these trade-offs.

4. Storage of data

We retain personal data that we collect when it is necessary for the purposes of the processing to do so. When it is no longer necessary, we will either delete or anonymise the personal data.

Contact Data and User Data are retained to keep a record of the contract we have/had and for accounting and tax purposes for seven full financial years after the end of the year in which the transaction took place. If you are a customer and it is deemed necessary for our legitimate interest to administer our customer relationship, the data may be retained for up to ten full financial years after the end of the year in which you ended your customer relationship with us. Information about partners and suppliers is stored for the duration of the contract and five years thereafter.

Marketing & Communications Data will be retained for as long as necessary for the purposes of the processing. If you have consented to receive advertising, we will keep evidence of your consent for five years after the last time we had evidence of your consent to send advertising. We will stop sending you e-advertisements when you withdraw your consent.

Technical data will mainly be stored for as long as necessary or as long as your consent, if any, is valid.

Recruitment data will be kept for 12 months after the end of the recruitment process to consider you for future positions.

Data may be retained for longer periods if we are legally obliged to do so, or if retention is necessary for the establishment, exercise or defence of legal claims.

5. Who may have access to your personal data?

In order to provide our goods and services to you, we may transfer to, or share your information with, selected third parties:

• Banks in connection with the administration of payments.
• Collection and credit reference agencies when loans/credits/claims are overdue and when searches are made by credit reference agencies in connection with the conclusion of contracts.
• Tax authorities, police and other authorities in connection with statutory reporting or other statutory obligations.
• External service providers in areas such as accounting, support and IT.
• External service providers in areas such as customer care, marketing and CRM systems.
• Professional advisors and other data processors under data processing agreements.
• Insurance companies.
• Third parties, when necessary for reasons of legal obligation. If we are required to disclose your personal data due to an injunction or similar, we will inform you to the extent that we are not legally prevented from doing so.

NorthTracker endeavours to process your personal data within the EU/EEA. To the extent that personal data is transferred to a processor outside the EU/EEA, standard contractual clauses approved by the European Commission (Standard Contractual Clauses) provide the personal data with substantially equivalent protection as if it had been processed within the EU/EEA.

6. Security measures and information security

NorthTracker strives to protect your personal data and maintains appropriate technical and organisational security measures to prevent inappropriate or accidental disclosure, use, unauthorised access, loss, alteration or damage of your personal data.  

• We follow the ISO 27001:2017 standard for information security management.
• We apply network segmentation in all our production environments to reduce risks.
• Our infrastructure is constantly updated with the latest security patches delivered by our service providers.
• We use a recognised method of access control, known as the principle of least privilege (PoLP), to ensure that only necessary access is granted to keep our infrastructure secure.

For more detailed information on our security measures, please visit our website www.northtracker.com.

7. Your rights and how to exercise them

Under current data protection legislation, you have a number of rights in relation to our processing of your personal data. More information on each of the rights you have as a data subject and the limitations of those rights can also be found on IMY's website https://www.imy.se/verksamhet/dataskydd/det-har-galler-enligt-gdpr/de-registrerades-rattigheter/

You have the right to:

• be informed about our processing of personal data, which gives you the opportunity to get information about when we process your data, why and for how long we keep it;

• get access to your personal data (record extract), which allows you to obtain a copy of the personal data we hold about you so that you can check that we are processing it correctly;

• request rectification of the personal data we hold about you, giving you the opportunity to have incomplete or incorrect information about you amended or completed;

• request erasure of your personal data ("right to be forgotten"). This mainly applies to data that (a) is no longer necessary for us to process or retain in relation to the purpose for which we collected the data, (b) if you choose to withdraw your consent to a processing that is based on your consent or (c) if the processing is for marketing purposes and you object to that processing. In some cases, we may not be able to delete all or some of your personal data. This may be because, for example, we are required by law to keep it;

• object to our processing of your personal data where our processing is based on a balance of interests. You also always have the possibility to object to us processing your personal data for direct marketing purposes;

• request restriction of processing of your personal data. The right to restriction applies, among other things, when you have notified us that you consider our data to be inaccurate and have requested rectification;

• request the transfer of personal data Under certain conditions, you have the right to obtain and use your data elsewhere;

• withdraw your consent. Where we process your data solely on the basis of your explicit consent, you have the possibility to withdraw that consent at any time. Such a withdrawal does not affect the lawfulness of the processing until the consent was withdrawn;

• lodge a complaint to the supervisory authority. If you are not satisfied with how we process your personal data, you have the right to lodge a complaint with the Swedish Data Protection Authority, which is the supervisory authority. You can find the contact details of the Authority at imy.se.

If you wish to exercise any of your rights, please send your request by e-mail to dataskydd@northtracker.com we will fulfil your request in accordance with the applicable data protection legislation.

When we process data on behalf of our customer in the performance of our services, any request for extended access, corrections or deletion, must be sent to us by our customer. If you are using our services on the basis of an employment or other relationship with our customer, you must contact the relevant person in the company, who can make the necessary decisions, including sending a request to us.

8. Data Protection Officer

If you have any questions about this privacy policy, concerns about how we handle your personal data or wish to make a complaint, please contact us at dataskydd@northtracker.com.

9. Changes to this privacy policy

This privacy policy may be updated from time to time. The latest version can be found on our website www.northtracker.com.