Privacy Policy

This privacy notice is effective from May 25th, 2018, and was last updated January 16, 2024.

Scope and purpose

This Policy has been adopted in order to assist in establishing and maintaining an adequate level of personal data privacy in the collecting, processing, disclosing and cross-border transfer of personal data, i.e. any information that relates to an identified or identifiable living individual (“Personal Data”) including that relating to current, past and prospective OX2 personnel, clients, investors, contractors, business associates and other stakeholder of the OX2 group.

OX2 AB’s (org.nr 556675-7487) and all its subsidiaries’ (hereinafter jointly referred to as “OX2”) processes and activities are performed with the objective to ensure that your privacy and integrity are protected, that your privacy is respected and that your personal information is processed correctly. We take responsibility to ensure that Personal Data processed by OX2 is used only for initial purposes and is protected against accidental or unlawful destruction, loss, use, or alteration and against unauthorized disclosure or access.

All processing of Personal Data by OX2 is carried out in accordance with applicable privacy legislation.

This Policy only applies to Personal Data which is processed by or on behalf of a OX2 and is or was processed at any time by or on behalf of OX2 in a jurisdiction which is either:

(i) in the EU or EEA; or

(ii) not in the EU or EEA, but is a jurisdiction which imposes similar restrictions on the use or extra-territorial transfer of Personal Data;

This Policy should not conflict with applicable national laws in the jurisdictions in which an OX2 company operates and the Policy shall be so construed wherever possible. In the event of any conflict between this Policy and any applicable national laws, the provisions of the relevant law shall govern. In this event, the relevant OX2 company shall immediately notify the OX2 General Counsel.

International data transfers by OX2 Group companies with registered offices in Europe

In addition to applying the below Key principles, in the event that any OX2 company with registered office within European Economic Area (EEA) transfers your Personal Data outside the EEA, we ensure that your data is protected in a manner which is consistent with the GDPR (EU 2016/679). Therefore, and if required by applicable law, we take the following measures:

• We share your Personal Data with affiliated companies outside the European Economic Area only if they have implemented our Binding Corporate Rules (“BCR“) for the protection of Personal Data.

We transfer Personal Data to external recipients outside the European Economic Area (EEA) only if the recipient has (i) entered into EU Standard Contractual Clauses with us, or (ii) implemented Binding Corporate Rules in its organization. You may request further information about the safeguards implemented in relation to specific transfers by contacting us.

Who is responsible for your personal information?

OX2 AB is OX2 Group’s main data controller. In addition, subsidiaries of OX2 AB can also be data controllers (including “joint-controllers”) and process Personal Data as described in this Privacy Policy. Your relationship with OX2 will determine which of our group companies that have access to and processes your Personal Data, and which of our group companies are the data controller(s) responsible for the personal information.

Key principles

In handling Personal Data as a controller OX2 will apply the following key principles:

1. Transparency: OX2 will provide individuals with information about how we process their Personal Data to the extent necessary to ensure that processing is fair.

2. Purpose limitation: OX2 will only process Personal Data for the purposes

(iii) set out in any notice made available to the relevant individuals;

(iv) as required by law; or

(v) where consented to by the relevant individuals.

3. Data quality and proportionality: Personal Data should be kept accurate and where necessary, up to date. The Personal Data OX2 hold must be adequate, relevant and not excessive for the purposes for which they are processed and should only be retained for as long as necessary for the purposes of the relevant processing.

4. Sensitive Data: Where OX2 process sensitive Personal Data, we will take such additional measures (e.g., relating to security) as are necessary to protect such Personal Data in accordance with applicable law.

5. Data minimization: Where OX2 retain Personal Data, we will do so in a form identifying or rendering an individual identifiable only for so long as it serves the purpose(s) for which it was initially collected or subsequently authorized, except to the extent permitted by applicable law; and

6. Information transfer and compliance: Within OX2, Personal Data may be transferred outside the country in which it was collected, including countries outside of the EEA, for legitimate business activities in accordance with applicable law. In addition, in accordance with applicable law, the OX2 may store Personal Data in facilities operated by OX2/or third parties on behalf of OX2 outside the country in which the data was collected. Nevertheless, Personal Data must not be transferred to another country unless the transferor has assurance that an adequate level of protection is in place in relation to that Personal Data as required under applicable law. In the case of each, an adequate level of protection is created by the Group Data Sharing Agreement which each OX2 group company shall abide by. OX2 will ensure that where Personal Data is transferred to third parties outside of OX2 for processing (for example to OX2’s service providers to support OX2’s business), that this is only done where the personal information is adequately protected. OX2 companies will achieve this by entering into written agreements with third parties which impose obligations that reflect the requirements of this policy.

Security

To protect your Personal Data against accidental or unlawful destruction, loss, use, or alteration and against unauthorized disclosure or access, we use adequate physical, technical and organizational security measures. Any disclosure of Personal Data is always in according to legal obligations, practices and standard procedures.

Your rights

The GDPR grants you as an individual specific rights in relation to your Personal Data. In particular, and subject to the legal requirements, you may be entitled to

• Obtain from us confirmation as to whether or not Personal Data concerning you are being processed, and where that is the case, access to the Personal Data;
• Obtain from us the correction of inaccurate Personal Data concerning you;
• Obtain from us the erasure of your Personal Data;
• Obtain from us restriction of processing regarding your Personal Data;
• Data portability concerning Personal Data, which you actively provided;
• Object, on grounds relating to your particular situation, to further processing of Personal Data concerning you; and
• Withdraw your consent to our processing of your Personal Data

How and when do we process your personal information?

Lawful basis of the processing: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subjects prior to entering into a contract (article 6.1 b GDPR).

Automated decision-making, including profiling (if applicable): No

Categories of recipients: OX2 AB (org.nr 556675-7487) and/or relevant subsidiary(ies)

The retention periods: We will save your Personal Data as long it’s necessary for the performance of a contract which the data subject is party (article 6.1 b GDPR).

Lawful basis of the processing: Processing is necessary for the performance of a contract to
which the data subject is party or in order to take steps at the request of the data subjects prior
to entering into a contract (article 6.1 b GDPR) and for the purposes of the legitimate interest
pursued by us a data controller (article 6.1 f GDPR).

More specific: To provide our products and services: Contract performance (article 6.1 b GDPR); Legitimate interest (article 6.1 f GDPR). 

To bill your use of our products and services: Contract performance (article 6.1 b GDPR); Legitimate interest (article 6.1 f GDPR). 

To verify your identity: Contract performance (article 6.1 b GDPR); Legitimate interest (article 6.1 
f GDPR).

To fulfil your requests or instructions: Contract performance (article 6.1 b GDPR); Legitimate interest (article 6.1 f GDPR).

To fulfil your requests or instructions: Contract performance (article 6.1 b GDPR); Legitimate interest (article 6.1 f GDPR).

When necessary to enforce the contractual agreement, to establish and preserve legal claims or defense, to prevent fraud or other criminal activities: Compliance with legal  obligations (article 6.1 c GDPR); Legitimate interest (article 6.1 f GDPR).

Automated decision-making, including profiling (if applicable): No

Categories of recipients: OX2 AB (org.nr 556675-7487) and/or relevant subsidiary(ies)

The retention periods: We will save your Personal Data as long it’s necessary in compliance with
the initial purpose and applicable legal obligations.

Lawful basis of the processing: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subjects prior to entering into a contract (article 6.1 b GDPR).

Automated decision-making, including profiling (if applicable): No

Categories of recipients: OX2 AB (org.nr 556675-7487) and/or relevant subsidiary(ies)

The retention periods: We will save your Personal Data as long it’s necessary in compliance with applicable legal obligation.

Lawful basis of the processing: The data subject has given consent to the processing of his or her Personal Data for one or more specific purposes (article 6.1 a GDPR).

Automated decision-making, including profiling (if applicable): No

Categories of recipients: OX2 AB (org.nr 556675-7487) and/or relevant subsidiary(ies)

The retention periods: We will save your Personal Data as long it’s necessary for the initial purpose. You control and/or delete cookies as you wish – for details, see our cookie policy.

Lawful basis of the processing: The data subject has given consent to the processing of his or her Personal Data for one or more specific purposes (article 6.1 a GDPR). You can withdraw your consent to our marketing at any time by contacting us.

Automated decision-making, including profiling (if applicable): No

Categories of recipients: OX2 AB (org.nr 556675-7487) subsidiary(ies)

The retention periods: As long as we have your consent to provide you with information and marketing.

Further information for OX2 Group's employees

Further information and privacy notices are available in the OX2’s intranet (OX2 intranet access is required).

Complaints, questions and additional information

To express a concern, raise a question, make a complaint, or to obtain additional information about the processing of Personal Data by OX2, the concerned individual should contact the Local Legal Counsel or the General Counsel (“the Data Privacy Organization”) for the relevant OX2 company in the first instance.

Besides contacting the Data Privacy Organization, you always have the right to approach the competent data protection authority in your country with your request or complaint.

Your Competent Data Protection Authority

Besides contacting our Data Privacy Organization, you always have the right to approach the competent Data Protection Authority with your request or complaint:

Download the privacy policy in PDF