Privacy policy

Last revised: 2023-03-17

Normative AB, 556967-7361 (“SME Climate Hub” or “we” in any form) is committed to protect the personal data and safeguard the privacy of our website visitors and contact persons for our customers, suppliers and other business partners. For more information about us, see Section 9.

This Privacy Policy describes how SME Climate Hub, in its capacity as a data controller, processes personal data in accordance with the General Data Protection Regulation (EU Regulation 2016/679) (hereinafter referred to as the “GDPR“).

1. Categories of personal data, processing purposes, legal bases, and retention

We generally collect personal data directly from you. Not providing your personal data may result in disadvantages for you, e.g. you may not be able to receive desirable information about us. However, unless otherwise specified, not providing your personal data will not result in legal consequences for you. We may also collect personal data from third party sources such as other software systems you might connect to through our website.

1.1 Ongoing business partners

If you represent an organization that we do business with, we process personal data in order to facilitate our business relationship with the organization which you represent, i.e. name and contact details such as full-name, title, e-mail address, telephone number, and postal code. We may also process personal data included in your personal profile on our website, full-name, title, e-mail address, telephone number, profile picture, and postal code, Our legal bases for processing of the personal data are our legitimate interests to conduct our business, consent or contract.

We will retain the personal data for as long as we have a business relationship, then up to a year to deprovision (with a longer retention if legally required).

1.2 Potential business partners

If you represent an organization that we consider to do business with, we process personal data in order to facilitate our potential business relationship with the organization which you represent, i.e. name and contact details such as full-name, title, e-mail address, telephone number. Our legal basis for processing of the personal data is our legitimate interests to conduct our business, or consent.

We will retain the data for as long as it may be relevant and up to one (1) year following our latest contact. Where the contacts have led to a business relationship, the personal data will be processed as described in the previous section, Ongoing business partners.

1.3 Customer support

In order to provide customer support, we process personal data regarding organizational belonging (if applicable), name, email address, phone number, device ID, location data, correspondence, matter number and information about the relevant enquiry. The correspondence data may be processed for the purposes of communicating with you and record-keeping. Our legal basis for processing personal data is our legitimate interests to conduct our business and communication with the person that has reached out to our customer support.

We will retain the data for up to six (6) months following the termination of the relevant service agreement.

1.4 Correspondence with other individuals

Occasionally, we engage in correspondence with individuals in other matters than those accounted for above. This may be the case where individuals have general questions about our services. Our legal basis for processing personal data in this respect is our legitimate interests to conduct our business, including to respond to such queries.

We will retain the data for as long as it may be relevant and up to one (1) year following the latest contact.

1.5 Newsletters

We process your name, contact information, organizational belonging and title and email address in order to provide you with marketing and product information in email notifications and/or newsletters. Our legal basis for doing so is consent or legitimate interests. Where the legal basis is consent, this can be withdrawn at any time by contacting us at [email protected]. You can also opt-out in each message by clicking on the unsubscribe link.

We will retain the data until you opt-out or withdraw your consent or during two (2) years following your latest activity.

1.6 Account data

We process your account data (“account data”). The account data may include your name, email address and work title. The source of the account data is you or your employer. The account data may be processed for the purposes of operating our website, providing our services, ensuring the security of our website and services, maintaining back-ups of our databases and communicating with you. The legal basis for this processing is our legitimate interests, namely the proper administration of our website and business.

We will retain the data for as long as it may be relevant and up to one (1) year following a termination of your account.

1.7 Branding

We publish material containing personal data to inform about our activities on our website or on social media. Our legal basis for doing so is our legitimate interests to inform about our business for branding purposes.

The data will be processed as long as it is relevant and as a maximum during the life of the company.

1.8 Press releases

The data will be processed as long as it is relevant and as a maximum during the life of the company.

1.9 Social media

We use Facebook, LinkedIn, Twitter and Instagram to market and inform about our company and our services and products. The legal basis is our legitimate interests to use such channels for marketing and information. The social media providers each inform about their privacy practices and we encourage you to inform yourself thereof.

The data will be retained as long as it may be relevant and for a maximum of three (3) years.

1.10 Automated technologies or interactions

As you interact with our website, we will automatically collect data about you and your device, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our Cookie Notice for further details. We use Google Analytics, a web analysis service provided by Google Inc. (“Google”). Google Analytics works using cookies. Google Analytics cookies collect your IP address; however, because IP anonymization is used on this website, your IP address will be shortened (and therefore anonymized) as soon as technically possible and before it is stored or otherwise used in connection with Google Analytics. We use the information collected by Google Analytics cookies to find out about how visitors use our website. Google will not combine the IP address sent by your browser in connection with Google Analytics with other data. You can prevent Google Analytics cookies from being stored by setting your browser software accordingly. Chrome users can also opt-out of Google Analytics by downloading and installing the browser plug-in available at google.com.

1.11 Handling Data Subject rights

We will process email address, name, correspondence and data about the request. Our legal basis for processing personal data is compliance with a legal obligation. The data will be retained as long as it may be relevant or legally required, normally under two (2) years.

2. Further retention context

Your personal data will be retained as long as necessary to provide you with products, services or communication. In addition to retention for the foregoing purposes, we may also retain your personal data in order to comply with applicable laws, such as bookkeeping laws, or if we need your personal data to establish, exercise or defend legal claims. Where the data is only stored, it will be archived with highly limited access rights.

To determine the appropriate retention period for your Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

3. Who do we share your personal data with?

SME Climate Hub may engage external service providers and outreach partners, who act as data processors of SME Climate Hub, to provide certain services to SME Climate Hub, such as website service providers, marketing service providers, IT support service providers and general outreach. In particular, the Business Climate Leaders campaign (“the campaign”) is promoted by the UK Government Department for Business, Energy and Industrial Strategy (“BEIS”). When providing such services, the external service providers may have access to and/or may process your personal data. We request those external service providers to implement and apply security safeguards to ensure the privacy and security of your personal data. Your personal data may also be shared with our business partners for marketing purposes, to the extent you have provided your consent.

In addition to the foregoing, SME Climate Hub may transfer – in compliance with applicable data protection law – personal data to law enforcement agencies, governmental authorities, legal counsels, external consultants, or business partners. In case of a corporate merger or acquisition, personal data may be transferred to the third parties involved in the merger or acquisition, including potential buyers, investors and professional advisers.
If you have completed the SME Climate Commitment form, SME Climate Hub may make available your climate and certain personal data that you have provided, as well as information on: the time of sign up, greenhouse gas emissions over time, and any information on the users’ actions for limiting emissions. Your name and contact details will not be made available or published in any way. SME Climate Hub will take appropriate technical and organizational measures to protect your personal data.

4. International transfers of Personal Data

Personal Data may be transferred to and processed by recipients which are located inside or outside the European Economic Area (“EEA”). The countries include those listed at the European Commission website which provide an adequate level of data protection from a European data protection law perspective. Other recipients might be located in other countries which do not adduce an adequate level of protection from a European data protection law perspective. SME Climate Hub will take appropriate measures to ensure that transfers out of the EEA are adequately protected as required by applicable data protection law. With respect to transfers to countries not providing an adequate level of data protection, we base the transfer on appropriate safeguards, such as standard data protection clauses adopted by the European Commission or by a supervisory authority, approved code of conducts together with binding and enforceable commitments of the recipient, or approved certification mechanisms together with binding and enforceable commitments of the recipient. You may find the European Commission standard contractual clauses here.

5. Data subjects’ rights

You have a number of rights in connection with the processing of your personal data, subject to certain conditions set out in the GDPR and local data protection laws, including the right to:

Request access to your personal data (“data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Request the rectification of the personal data that we process about you. This enables you to have incomplete or inaccurate data we hold about you corrected.
Request the deletion of your personal data. This enables you to ask us to delete or remove personal data where there is no overriding reason for us to retain it.
Ask us to stop processing personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground.
Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of Personal Data provided by you either to you or a third party (“data portability”);
Object to the Processing of your Personal Data in certain circumstances. Where we are processing your Personal Data on the basis of our legitimate interests or where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, you can ask us to stop processing it and we must do so unless we believe we have an overriding legitimate reason to continue processing your personal data or we need to process your personal data to deal with a legal claim.
The exercise of these rights is not absolute and may be subject to certain pre-conditions and exemptions under data protection laws.

If you have given your consent for processing of your personal data and that consent has served as a legal basis for processing, you can withdraw this consent at any time with future effect by contacting us as stated in the Contact us section below.

To exercise your rights please contact us as stated below in Section 9.

In case of complaints you may contact our Data Protection Officer at [email protected] and you also have the right to lodge a complaint with the competent data protection supervisory authority in particular in the EU Member State of your habitual residence, place of work or of an alleged infringement of the GDPR. In Sweden, this is the Swedish Authority for Privacy Protection (www.imy.se).

6. Cookies and other tracking technologies

This website uses cookies. For further information please visit our Cookie Policy.

7. Children’s privacy protection

The SME Climate Hub is not designed for, or intentionally targeted at, children who are under 13 years of age.

8. Changes to the Privacy Policy

SME Climate Hub reserves the right to change this Privacy Policy at any time. We will give you reasonable notice of any changes to the Privacy Policy, where appropriate. If so, we will notify you by a message or by email. You will also find the date of the latest change to the Privacy Policy on this website.

9. Contact information

This website is owned and operated by the company Normative AB.

We are registered in Sweden under registration number 5569-677361, and our registered office is at Folkungagatan 44, 118 26 Stockholm, Sweden.

If you have concerns or questions regarding this Privacy Policy, please contact us by email [email protected].