Terms and Privacy Policy

WIST LAST & BUSS AB

PRIVACY POLICY

Wist Last & Buss values your personal integrity and through this privacy policy we want to inform you about how we handle your personal data. We process your personal data in accordance with applicable legislation and data protection rules.

Who is responsible for your personal data?

Wist Last & Buss AB, org. no. 556078-9751 is responsible for your personal data.

What personal data does Wist Last & Buss process?

The personal data we process is the information you have provided to us or that we have collected from you or a third party.

Personal data you have provided to us: When you make a purchase with us, hire/borrow/test drive a vehicle, enter into an agreement on tyre storage, sell your vehicle to us or bring your vehicle to one of our workshops, you will provide certain information about yourself to us, as well as when you register a customer account with us. You may also provide information to us for other reasons, e.g. when you have been in contact with us through one of our many channels or if you have visited one of our events or stores. The information you provide may include your name, the registration number of your vehicle, your contact details, card number, other financial information or your personal identity number or questions about products or services you want to know more about or information about your vehicle that you have provided to us.

Personal data we have collected from you or a third party: When you bring your vehicle to one of our workshops for repair or service, we will collect information about your vehicle. The information is primarily of a technical nature such as data on mileage, status of various components, use of the vehicle's functions and analysis of the vehicle's various characteristics. During workshop visits, we will also save information about the workshop visit, performed troubleshooting and the work carried out, including the products repaired, replaced or installed. We collect information about the vehicle's various identification numbers and this is also collected when you buy or lease a vehicle from us. If credit is provided, we may perform credit checks. If you visit our website, we may also automatically collect personal data via the website, for example information about your IP address.

We may also process data about you that we, for marketing purposes, or to improve your customer experience, have purchased or obtained access to from public registers and databases, e.g. national vehicle registers or various credit reporting services.

The personal data mentioned above may also be processed about you in cases where someone else brings your vehicle to us for repair or service on your behalf. If you bring in a vehicle that someone else is the registered owner of, or if you represent a company, we process your name and your contact details.

For what purposes do we process your personal data?

All collection and processing of personal data is for the purpose of administering and fulfilling our obligations to you, improving our offers and services and communicating these to you, and to safeguard our rights and fulfil our obligations under law or agreement.

In order to fulfil our agreement with you or to take measures at your request before an agreement is entered into, we process the following personal data for the following purposes:

• We process your name and contact details, your customer number, registration number, vehicle information, information about the products or services you have purchased/hired/leased/borrowed or wished to inquire about, and payment information (e.g. card number or billing address) for the purpose of administering our customer relationship, including your payment. We also process this information to fulfil our obligations arising from the agreements you have entered into with us and to provide you with the information about the products and services you have requested from us. If you have a customer account with us, we also process information about your purchase history and information about your user profile. Information stored in the vehicle's computer may be processed to perform service and maintenance or to perform troubleshooting and identify and rectify faults in the vehicle.
• We process information about your name, your purchase and contact details, information about your purchase, registration number and any vehicle information in order to handle any claims for right of withdrawal, complaints, demands or warranty.
• We process information about your name, personal identity number and driving licence details, and information about your financial situation in order to verify your identity when entering into agreements with you, for driving licence authorisation checks and to perform credit assessments. The processing of your personal identity number is clearly justified given the importance of secure identification in connection with entering into our agreements and for releasing vehicles in connection with test drives.
• When you have test driven/leased/hired/borrowed a vehicle from us, we process information about your name, contact details, the period of time and which vehicle you have had at your disposal, so that we can administer or recharged any fines, fees or damages and the like connected to the time you had the vehicle at your disposal.
• To perform testing of the IT systems used to administer your order of our products or services, in order to ensure that these maintain a high quality and security level.

For the following purposes, we process your personal data on the basis of a balancing of interests:

• We process information about your purchases, information about workshop visits and your contact details for the purpose of developing our business and customer offerings, performing customer analysis, troubleshooting, support, testing, and for statistical purposes and surveys. Our legitimate interest in processing your personal data is to improve our offerings, ensure customer satisfaction and that our systems maintain a high quality and security level.
• We process your contact details to communicate with you as a customer or potential customer by sending direct marketing, newsletters, service reminders etc. and customer surveys by post, email, SMS or other digital channels, provided that you have not objected to the processing. Our legitimate interest in processing your personal data is that we want to communicate with you as a customer or representative of a company for marketing purposes.
• We process service and repair history for the purpose of using the information for diagnosis, upgrading, repair and service of your vehicle. Technical information may also be used for product or service development. The information is also stored to be able to offer a potential future owner of your vehicle access to service history and other vehicle-related information that may be relevant for them to know, such as when a certain spare part was replaced or what service has been performed on the vehicle. Our legitimate interest in processing your personal data is to be able to demonstrate that we fulfil requirements from the respective vehicle manufacturers, for safety reasons and to be able to offer our customers the right workshop services.
• If you bring in a vehicle to one of our workshops on behalf of someone else or as a representative of a company, we process your name and contact details and vehicle information to the extent necessary for us to fulfil our obligations to our customer. Our legitimate interest in processing your personal data is that we want to be able to communicate with you as a contact person and that we may need to follow up who brought in the vehicle to us.
• If someone else brings your vehicle to us, we process your name, contact details and vehicle information to perform the work for the purpose of fulfilling our agreement on repair or service in relation to the person who brought in your vehicle. Information stored in the vehicle's computer may be processed to perform service and maintenance or to perform troubleshooting and identify and rectify faults in the vehicle. Our legitimate interest in processing your personal data is to be able to fulfil our agreement in relation to the customer and carry out the current service or repair on your vehicle.
• We may process moving material from surveillance cameras containing personal data about you when you visit one of our facilities, for crime prevention purposes. Surveillance only takes place in areas that are particularly exposed to crime.

For the following purposes, we process the following personal data if you have given consent to it:

• If you have registered a customer account with us, you have given your consent for us to process the information you have provided to us and information about purchase history and bid history for the purpose of administering your account and designing personal communication to you.
• If you have consented to receive direct marketing, e.g. newsletters, SMS reminders, campaign information etc. from us, we process your contact details for this purpose for a longer period.
• If you have consented to it or if we otherwise have the right to do so in accordance with applicable law and practice, we will analyse information about purchase history, vehicle data we have collected from your vehicle in connection with a workshop visit or information we otherwise have about your vehicle such as model and year of manufacture, e.g. when you have purchased a vehicle from us. The analysis of the information is done for the purpose of sending personal and relevant offers to you.
• To fulfil legal obligations:
• We also process your data to the extent that the processing is necessary to comply with applicable legislation, authority decisions and any other legal obligations incumbent on Wist Last & Buss. For example, we store information about your agreement with us to the extent necessary to comply with applicable accounting legislation.

Who can gain access to your personal data?

Your data is in principle only processed by Wist Last & Buss. Your personal data may be shared with actors who process personal data on our behalf, so-called data processors. Wist Last & Buss uses external suppliers for various purposes, e.g. data storage or other data management, IT support, financial and payment services, distribution of goods or information, printing, marketing or analyses. In these cases, the supplier has no own right to use any personal data and Wist Last & Buss enters into data processing agreements on personal data processing with the supplier.

Wist Last & Buss may also disclose your data to the following actors who are themselves responsible for personal data controllers for their handling of your data:

• We may disclose your personal identity number and financial information to credit companies for credit checks.
• We may disclose your contact details and vehicle information to vehicle manufacturers and the general agent for the respective vehicle brand. It is primarily vehicle information that is disclosed but to handle recalls and warranty matters, contact information is also disclosed to these actors.
• We may also disclose vehicle information to other actors within the vehicle manufacturer's authorised network so that the network can offer customers the right workshop services.
• We may also disclose your personal data to insurance companies when you buy a vehicle from us or bring in a vehicle for service or repair, e.g. in the case of damage repairs.
• We may disclose your data to authorities because it is necessary or because they have the right to information, e.g. for registration of vehicles in the road traffic register.
• We also want to inform you that it may be our partners who are the personal data controllers when you use our workshop services, purchase additional services or products delivered by one of our partners (e.g. vehicle information collected by vehicle manufacturers or information if you take out insurance or financing with financial or insurance companies we work with). These actors then have their own responsibility to inform you about the handling of your personal data.

How do we protect your personal data?

We, and where applicable our partners, have taken several security measures to protect the personal data being processed. We have redundant firewalls with intelligent intrusion protection that protect against external threats to protect and prevent unauthorised access to our networks and systems. Physical access to data is protected via diversified perimeter protection where only authorised personnel have access. Our employees have strict instructions to handle all information in accordance with applicable laws, rules and policies. Only those who need access to systems where personal data is stored are given access and all data is protected with access rules. Analyses are carried out regularly, both internally and externally, to identify and correct any vulnerabilities.

We and our partners, as a general rule, only process your personal data within the EEA. In cases where the information is processed outside the EEA, this is only done in accordance with applicable data protection legislation.

How long do we store your personal data?

Depending on the purpose underlying a particular processing of your personal data, Wist Last & Buss stores your personal data for different lengths of time. We do not store your data longer than we have the right to under data protection legislation, other relevant legislation, rules and guidelines from various authorities or recommendations from industry bodies. Below we have listed some examples of how long we store your personal data.

When you have purchased our products or services, we store your data as a starting point for as long as the customer relationship exists and sometimes longer to fulfil obligations under law or agreement.

Vehicle information is stored for the vehicle's estimated "lifespan".

In accordance with applicable legislation, we have the right to store your contact details for direct marketing for a period after your purchase or after our agreement has expired. Depending on what the agreement concerns, this period is of different lengths. Wist Last & Buss may therefore store your contact details to send direct marketing to you for the period we have the right to do so under applicable data protection legislation, marketing law and practice.

If you have specifically given your consent to receive direct marketing, newsletters and reminders, we will store this personal data until you unsubscribe or ask us to stop contacting you.

For those who have registered a user account with us, we process all your personal data until you deregister your account with us.

In cases where the data has been collected from a third party for use in direct marketing, the data is not stored longer than Wist Last & Buss has the right to do so and where clear rules or guidelines are lacking, the data is deleted within one year.

For accounting purposes, in accordance with applicable accounting legislation, we store information required by such law about our agreement with you for seven years after the year the agreement was entered into.

Your personal data may be stored longer than stated above to the extent we are obliged to do so by law, regulation or authority decision.

How can you influence our processing of your personal data?

You have the right to withdraw all or part of a given consent to the processing of personal data at any time. However, the withdrawal of your consent has no effect on our processing of your personal data for the period before the withdrawal took place. You also have the right to object to the processing of your personal data for direct marketing or profiling at any time.

In accordance with applicable data protection legislation, you have the right to access information about what personal data we process about you and the right to request correction of your personal data.

Under certain conditions, you also have the right to request deletion or restriction of your personal data or to object to our processing. You also have the right, under certain conditions, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and have the right to transfer this to another data controller (data portability). You also have the right to lodge a complaint with the Swedish Data Inspectorate or another competent supervisory authority that supervises companies' handling of personal data.

You never need to provide your personal data to Wist Last & Buss, but if you do not, we usually cannot enter into or fulfil an agreement with you.

Contact information

If you wish to exercise your rights, you can fill in the form below and email it to Wist Last & Buss at gdpr@wistlastbuss.com

If you have questions about our handling of personal data, you are also welcome to contact us by phone by calling Persson Invest Ekonomipartner switchboard: +46 63-16 26 90.

This privacy policy was established by Wist Last & Buss AB April 2018.