Privacy policy

Data controller

Varma Leads is a trading name of Ready Check Group AB. We are the controller for the processing described in this policy unless stated otherwise.

Company

Ready Check Group AB

Reg. no.

559546-8140

Address

Södra Stapeltorgsgatan 28, 802 53 Gävle, Sweden

Contact

johan@varmaleads.se

We are not required to appoint a data protection officer and have not appointed one. Questions about personal data are answered at the address above.

Two kinds of personal data

We process personal data in two clearly separate contexts, and the rules differ between them. It is worth knowing which one applies to you before reading on.

• Visitors and customers. You have visited the website, started a free trial or bought something from us. That is covered in section 3.
• People in our lead lists. You have never been in touch with us, but your professional details may appear in a list we produced for a customer. That is covered in section 4, which is written for you.

Visitors, trial users and customers

When you use the website, start the free trial or become a customer, we process the following.

We use no cookies for advertising or profiling. What we measure, and why the site shows no consent banner, is described in our cookie information.

People in our lead lists

This section is written for people who appear in a list we produced without ever having been in touch with us. We collected your details from sources other than you, and the GDPR requires us to tell you the following.

What we hold

Details about you in your professional role: name, job title, employer, the town your workplace is in, the workplace address, work email address, work phone number and a link to a public professional profile. We never knowingly collect private addresses, personal phone numbers or information about you as a private individual.

We never process special categories of data — health, ethnic origin, political opinions, trade union membership, religion, sexual orientation or biometrics — and we never search for them.

Where the data comes from

From commercial B2B databases we are licensed to use, and from companies' own public websites, which we read automatically to judge whether the company matches the customer's criteria. Sometimes the company list comes from the customer, and we complete it. If you want to know which source a particular detail came from, we will tell you on request.

Why, and on what legal basis

The purpose is to provide our customers with a basis for business-to-business direct marketing. The legal basis is legitimate interest under Article 6(1)(f). We have carried out a balancing test and concluded that our interest, and our customers', in being able to make contact in a professional context outweighs the limited intrusion that professional details represent — particularly because the data concerns you as an employee, is limited to a handful of fields, contains nothing sensitive and is not used to profile you as a person. You may object at any time, and the processing then stops. We will send you the balancing test on request.

For how long

We delete the data from our own systems no later than 60 days after the list is delivered. We do not keep it as a permanent database. The customer who received the list is thereafter a controller in their own right for their copy, responsible for their own retention period and for informing you under Article 14 when they make contact.

The one thing we keep for longer is a suppression list: if you object, we retain your contact details in a limited record for the sole purpose of keeping you out of future lists. It is never used for anything else.

Who we share data with

We do not sell your personal data to anyone other than in the form of the ordered lead list, to the customer who ordered it. Beyond that, data is shared with the suppliers that run our systems. They process it on our behalf under data processing agreements and may not use it for their own purposes.

We also disclose data where the law requires it, for example to an authority acting under statute.

Transfers outside the EU/EEA

Some of the suppliers above are established in the United States. Those transfers rely on the European Commission's standard contractual clauses and, for certified suppliers, on the EU–US Data Privacy Framework. We store data in the EU wherever the supplier offers it.

Your rights

You have the right to ask us for the following. We respond without undue delay and within one month at the latest, at no cost.

• Confirmation of whether we process data about you, and if so a copy of it.
• Rectification of inaccurate data, and completion of incomplete data.
• Erasure, where the conditions for it are met.
• Restriction of processing while an objection or a rectification is being considered.
• Objection to processing based on legitimate interest. Where the objection concerns direct marketing, the processing always stops, with no balancing test.
• Data portability for the data you provided to us yourself.

Write to us at the address below. If you are unhappy with how we handle your data you have the right to complain to the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, imy@imy.se.

Security

Data is stored in services that encrypt it in transit and at rest. Access is limited to those of our staff who need it to do the work, protected by two-factor authentication, and logged. In the event of a personal data breach likely to result in a risk, we notify IMY within 72 hours and inform those affected where the law requires it.

Changes to this policy

We update this policy when our processing changes. The date at the top shows when it was last amended. We inform our customers directly of any material change.