1. Introduction

1.1 This privacy policy (the “Privacy Policy”) describes how Pamica AB, reg. no 559028-8147, Pamica 2 AB, reg. no 559122-1725, Pamica Partner KB, reg. no 969777-5006, and Pamica Partner II KB, reg. no 969778-3372, and Pamica Group AB, reg. no 559374-3643 (“Pamica”, “we”, “us” and “our”), process your personal data as a data controller.

1.2 We respect and safeguard your personal integrity. It is therefore important for us to protect your personal data and ensure that our processing of your personal data is correct and lawful. We ask that you read this Privacy Policy carefully and familiarize yourself with its content. We may sometimes need to make updates or changes to this Privacy Policy.

2. The content of this Privacy Policy

2.1 This Privacy Policy applies to processing of personal data of visitors at Pamicas website https://www.pamica.se/. This Privacy Policy also applies to processing which is initiated when you as an investor in Pamica’s fund structure or as a representative of such an investor use our services, for example when you as an investor visits the investor portal of Pamica at the website https://pamica.konfident.io/, as well as when you as a customer, supplier or representative of a customer or a supplier, purchase our services or provide services to us.

2.2 This Privacy Policy will for example include information on for what purposes we process your personal data, with which parties we share your personal data as well as information on your rights as a data subject.

2.3 If you want to read more about how we manage cookies on our website, please read our cookie policy.

3. What categories of personal data do we process, for what purpose do we process them and on what lawful basis do we base or processing activities?

3.1 How we in general terms process your personal data

3.1.1 We process your personal data in the way and for the purposes described below in this Clause 3, and we are accountable in the role as data controller for the processing activities described in each case.

3.1.2 We need to base each purpose on a lawful basis. A lawful basis can for example be (i) your consent to the specific processing activity, (ii) that the processing is necessary for the performance of a contract to which you as data subject is party, (iii) that we, based on weighing of interests, have a legitimate interest to process your personal data, which is not overruled by your interest of not having your personal data processed. In the text below you will find on what lawful basis we process your personal data, for what purpose we process your personal data as well as for what period in time we will keep your personal data.

Purpose: To communicate with you via our contact form on our website.
Processing activities:
• This includes e.g. communication via e-mail about our business, our services and our ongoing activities, with you who have chosen to contact us via our contact form on our website.
• Storage and use of such information that occurs in our communication between us.
Categories of personal data:
• First and last name.
• Contact information, such as e-mail address and telephone number.
• Information about the company you represent.
• Information that you otherwise provide us with in connection with us communicating with you, for example in the message you provide in our contact form.
Lawful basis: Legitimate interest, where our legitimate interest is to be able to communicate with you and respond to the messages you send to us when you contact us via our contact form on our website.
Retention period: We process your personal data as above as long as your request is still unanswered or as long as our communication is ongoing, but no longer than six (6) months after the last communication has ceased.

Purpose: In order to maintain, facilitate and improve the functions and user experience of our website and investor portal, as well as support our work on detecting and counteracting flaws, breaches and incidents.
Processing activities:
• In order to fulfil the purpose we use analytic tools offered by third parties. The statistics created and analytic activities pursued with support of these services is conducted with use of data in aggregated form and with de-identified or anonymised data.
• Collection of statistics and analysis of visitor traffic on our website as well as analysis of other technical information which is generated upon visiting our website or investor portal.
Categories of personal data:
• IP-address.
• Other technical information which is generated upon visiting our website or investor portal, such as what type of device is used, web browser used, history of visited sites including the time entry (information from used web browser, time zone of the place from which you visited our website and other information on web traffic).
Lawful basis: Legitimate interest, wherein our legitimate interest is to gather information in order to maintain, facilitate and improve the functionality, content and security on our website and investor portal. Gathering of information through use of cookies or other similar technologies is done on the basis of your consent, except such use which is strictly necessary to the foundational functions of our website and investor portal. For more information on how we use cookies and other similar technologies, please see our cookie policy.
Retention period: We process and keep information of how visitors interact with our website for a period of maximum six (6) months. In most cases, the collected data will be transformed into aggregated data (thus anonymised) at an earlier stage, in connection to us creating statistics.

Purpose: In order to initiate a business relation with you or the firm you represent.
Processing activities:
• Including for example communication via email regarding our business, services and current activities, with you in the role as contact person of a potential customer, business partner, supplier, investor or business contact in general.
• Retention and use of data, reports and analytics regarding ownership and internal management matters, organisation structures and employees of objects to acquire which are collected from third parties.
Categories of personal data:
• First name and surname.
• Contact details, such as email address, phone number, residence/location and address.
• Professional role/title as well as information about the firm you represent.
• Information which you provide us with when we are communicating with you.
Lawful basis: Legitimate interest, wherein our legitimate interest is to create a business relation with you or the firm you represent.
Retention period: We process and keep your personal data for a period of six (6) months from the time of gathering the data. If a business relation is established between Pamica and you or the firm you represent during the mentioned time period, then your personal data will be processed in accordance with the purposes mentioned below.

Purpose: In order to maintain and develop our business relation with you or the firm you represent.
Processing activities:
• Contact and communication with you in the role of a contact person for any of our existing customers, investors, business partners, suppliers or business contacts in general.
• Administration of our customer-, investor-, partner- and supplier contracts as well as communication regarding contact related matter.
• Communication via email about the business, services and current activities of our company or the company you represent.
Categories of personal data:
• First name and surname.
• Contact details, such as email address, phone number, residence/location and address.
• Professional role/title as well as information about the firm you represent.
• Information which you provide us with when we are communicating with you.
Lawful basis: Legitimate interest, wherein our legitimate interest is to maintain and develop our business relation with you or the firm you represent.
Retention period: We process and keep your personal data as long as we have a business relationship with you or the firm you represent, however for a maximum of three (3) years from the time we last were in contact because of our business relation. We may however be required to keep personal data for a longer period of time for other purposes, for example for establishment, exercise or defence of legal claims. We may also need to keep personal data for a longer period of time in order to comply with legal obligations, such as matters including our bookkeeping obligations according to the bookkeeping legislation.

Purpose: In order to enter into or perform contractual obligations between us and you or the firm you represent.
Processing activities:
• Administration and communication in order to enter into a contract or perform contractual obligations with/for you or the firm you represent.
• This includes for example invoicing as well as customary management, follow-up and documentation of contract related questions.
Categories of personal data:
• First name and surname.
• Contact details, such as email address, phone number, residence/location and address.
• Professional role/title as well as information about the firm you represent.
• Information which you provide us with in contract related matter, such as questions regarding agreed services.
Lawful basis: Processing is necessary in order for us to enter into agreements and/or perform our contractual obligations with/for you or the firm you represent. If you act on behalf of others, for example in the role of a representative of a customer, investor, business partner or supplier of Pamica, then our processing is based on legitimate interest, wherein our legitimate interest is entrance and performance of contracts with the firm you represent.
Retention period: We process and keep your personal data for as long as the contract is valid and for a maximum of three (3) years thereafter. We may however be required to keep personal data for a longer period of time for other purposes, for example for establishment, exercise or defence of legal claims. We may also need to keep personal data for a longer period of time in order to comply with legal obligations, such as matters including our bookkeeping obligations according to the bookkeeping legislation.

Purpose: In order to provide the investor portal in which you as an investor or a representative of such an investor can view and manage the fund holdings as well as use related portal services.
Processing activities:
• Retention and use of login credentials.
• Administration and communication in order to enter or perform, as well as administer a contractual matter between Pamica and you or the company you represent.
Categories of personal data:
• Login credentials consisting of username and password, phone number, email address or e-identification in the form of Bank ID.
• Social security number.
• First name and surname.
• Contact details, such as email address, phone number, residence/location and address.
• Professional role/title as well as information about the firm you represent.
• Information which you provide us in investment related matter.
• Investment information.
Lawful basis: The processing is necessary in order for us to provide our investor portal to you as investor in any of Pamica’s fund structure, which is part of entering, performing and administering contractual matters with you or the company you represent. If you act on behalf of others, for example in the role as representative of a company, then our processing is based on legitimate interest, wherein our legitimate interest is entrance and performance of contracts with the firm you represent.
Retention period: We process and keep your personal data as long as we have a business relation with you or the firm you represent, however for a maximum of three (3) years from the time we last were in contact because of our business relation. We may however be required to keep personal data for a longer period of time for other purposes, for example for establishment, exercise or defence of legal claims. We may also need to keep personal data for a longer period of time in order to comply with legal obligations, such as matters including our bookkeeping obligations according to the bookkeeping legislation.

Purpose: In order to host digital annual general meetings for shareholders.
Processing activities:
• Administer and send invites to the meeting via email.
• Retention of your contact details in connection with, during the preparations of, as well as during the following work with hosting a digital annual general meeting for shareholders.
Categories of personal data:
• First name and surname.
• Contact details, such as email address, phone number, residence/location and address.
• Financial information, such as voting right, information on shareholding and rights associated with such holding.
• Notes in the meeting protocol (e.g. notification of dissenting opinion or questions).
• Voting history.
• Your role during the meeting.
Lawful basis: Legitimate interest, wherein our legitimate interest is to host our annual general meeting for shareholders digitally for efficiency reasons.
Retention period: We process and keep your personal data in connection with hosting the digital annual general meeting for shareholders, during the preparations, as well as the following work with the meeting, however for a maximum of two (2) months from the time when you were invited to the digital annual general meeting. We may however be required to keep personal data for a longer period of time for other purposes, for example for establishment, exercise or defence of legal claims.

Purpose: Organization of events.
Processing activities:
• Administer and send e-mails regarding event invitations and information regarding the event.
• Storage of your information in connection with, during preparations for, and in the subsequent work with the event.
• Sharing your information with our subcontractors and partners with whom we collaborate to organize the event.
Categories of personal data:
• First and last name.
• Contact information, such as e-mail address, telephone number, place of residence and address.
• Any member ID relevant for the event.
• Food preferences.
• Transport and accommodation information during the event.
• Professional title and information about the company you represent.
• The information that you otherwise provide us with in connection with us communicating with you.
Lawful basis: Legitimate interest, where our legitimate interest is to be able to hold events for you as an investor, if you are part of the management of one of our portfolio companies or are a representative of some of our investors, customers or suppliers.
Retention period: We process and save your personal information for as long as necessary to be able to carry out the event and three (3) years after your last participation in one of our events.

Purpose: Marketing purposes.
Processing activities: Administer and send marketing by email.
Categories of personal data:
• Email address.
• First name and surname.
Lawful basis: We will only send you direct marketing via email if you have subscribed and registered for such marketing and thus have consented to receive them.
Retention period: We process and keep your personal data in order to administer and send out marketing via email as long as you do not unsubscribe (withdraw your consent). Such unsubscription can be done whenever by using the link for unsubscription which is featured in all our marketing emails.

3.2 To comply with our legal obligations or to exercise legal claims

3.2.1 We may process your personal data in order to comply with legal obligations according to legislation which is applicable to our operations and organisation, or to comply with a decision by public authority or court which requires us to keep and process your personal data.

3.2.2 We may also process your personal data because you or the firm you represent, ourselves or affected third party shall be able to establish, exercise or defend a legal claim, for example upon forthcoming or ongoing dispute.

4. From where do we collect your personal data?

We process personal data which are collected directly from you, from the firm you represent, as well as personal data which are collected via use of cookies. If you are an employee, a shareholder or are part of the management, for example as member of the board or managing director of an object which is evaluated for acquisition, then we will also collect your personal data from third parties, such as from brokers.

5. What happens if you do not want to share your personal data with us?

It is possible that the functionality of our website becomes limited and does not work as you may expect if you choose to not accept cookies.

6. How we share your personal data

Access to your personal data is limited to parties which needs access in order to fulfil the purposes described under Clause 3 above. We will share your personal data with the following parties in order to fulfil the stipulated purposes under Clause 3 above:

(a) Suppliers of IT-services and analytic tools for our website. We use third party suppliers in order to manage parts of our business. We may share personal data with these suppliers in connection to them providing services to us. Whenever using suppliers, we establish data processor agreements as well as take other adequate measures in order to make sure that your personal data is processed in a way that conforms with this Privacy Policy;

(b) Banks, insurance companies and other companies with which we cooperate. We may disclose your personal data to banks, insurance companies, legal advisers and other companies with which we cooperate in order to fulfil our obligations according to the investor agreement with you, to be able to organize events, to fulfil legal obligations or because we have a legitimate interest in sharing your personal data that outweighs your interest or your fundamental rights or freedoms.

(c) Companies and representatives within our investing network. We may share your personal data with companies and representatives within our investing network. If we share your personal data with companies and representatives within our investing network, we will make sure that your personal data are being processed in a way that conforms to this Privacy Policy.

7. Will we transfer your personal data outside of EU/EEA?

We may transfer your personal data to countries outside of the European Union (“EU”)/European Economic Area (“EEA”). If the European Commission has not issued a decision that the country to which your persona data are transferred has an adequate level of protection for your personal data, then we will provide a description of what safeguarding measures we have taken and what lawful basis we base the transfer upon in order to ensure that the transfer of your personal data is done in accordance with European data protection legislation. Please contact us by sending us a written notice if you want to have more information about whether we have transferred your personal data outside of EU/EEA, what countries we have transferred your personal data to and what safeguarding measures we have taken to protect the transfer.

8. Your rights as data subject

8.1 In this section we describe your rights under applicable European data protection legislation. You will not be charged if you want to exercise your rights and you can exercise them by contacting us. Do not hesitate to contact us if you have any questions regarding your rights.

8.2 Please note that we will always do an assessment of a request of exercising a right in order to determine whether the request is legitimate. Not all rights listed below are absolute and there are exemptions which can be valid.

8.3 Your rights are the following:

(a) Right of access. You have the right upon request to get a copy of your personal data which we process and to get complementary information regarding our processing of your personal data.

(b) Right of rectification. You have the right to have your personal data rectified and/or complemented if they are wrong and/or incomplete.

(c) Right to erasure. You have the right to request that we erase your personal data without undue delay in the following circumstances:
(i) the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(ii) you withdraw your consent on which the processing is based (if applicable) and there is no other legal ground for the processing;
(iii) you object to our processing of personal data and we do not have any overriding legitimate grounds for the processing;
(iv) the processed personal data is unlawfully processed; or
(v) the processed personal data has to be erased for compliance with legal obligations.

(d) Right to restriction. You have the right to restrict the processing of your personal data in the following circumstances:
(i) You contest the accuracy of the personal data during a period enabling us to verify the accuracy of such data;
(ii) the processing is unlawful and you oppose erasure of the personal data and request restriction instead;
(iii) the personal data is no longer needed for the purposes of the processing, but are necessary for you for the establishment, exercise or defence of legal claims; or
(iv) you have objected to the processing of the personal data, pending the verification whether our legitimate grounds for our processing override your interests, rights and freedoms.

(e) Right to data portability. If your personal data has been provided by you and our processing of your personal data is based on your consent or on the performance of a contract with you, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format in order to transmit these to another service provider where it would be technically feasible and can be carried out by automated means.

(f) Right to object. You have the general right to object to our processing of your personal data when it is based on our legitimate interest. If you object and we believe that we may still process your personal data, we must demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

(g) Right to object to direct marketing. You have the right to at any time object to processing which is done for the purpose of direct marketing. If you object to such processing, we will no longer process your data for such purposes.

(h) Right to withdraw consent. When our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Please note that the lawfulness of any processing based on your consent before its withdrawal is not affected by the withdrawal.

9. Complaints to the supervisory authority

The data protection authority in Sweden is ‘Integritetsskyddsmyndigheten’. If you believe that our processing is performed in breach of applicable data protection legislation, we encourage you in first hand to contact us in order for us to oversee your complaints. You may at any time also file a complaint at the supervisory authority.