This privacy policy describes how Helix Sweden AB, Reg. No. 559210-7354 (“Helix”, “We”) process your personal data.

Controller:

Helix Sweden AB
Florettgatan 19

SE-254 67 Helsingborg

Sweden

info@onnicotine.se

As part of our business, Helix processes personal data for which Helix is the data controller. This means that Helix is responsible for ensuring that the processing of personal data is carried out in accordance with applicable law and this privacy policy. We care about protecting your personal data and comply with all applicable laws and regulations that exist to protect the privacy of individuals.

Below is a description of how Helix processes your personal data depending on how and for what purpose the personal data is collected.

Under each heading, you will find information about how We process your personal data, the purpose of the processing, which categories of personal data are processed and the legal grounds on which our processing relies.

In certain situation, for instance in connection with some of the market research activities that we administer, your personal data may be processed by third parties acting as separate data controllers. In these situations, you will receive information about the identity of the third party and get access to the third party’s privacy policy for further information about how your personal data is being processed.

1. Website
When you visit our website, We process the following categories of personal data to the extent necessary to make our website accessible:
i) your IP-address;
ii) information about the type and version of browser used;
iii) the visitor’s operating system;
iv) time and date of the visit to the website;
v) websites from which the visitor’s system has reached our website; and
vi) websites to which the visitor’s system has connected via our website.

Purpose: The above-mentioned categories of personal data are, as applicable, processed by us in order to make our website accessible and for you to be able to visit our website.

Legal basis: The processing is based on our legitimate interest in being able to make our website accessible as We have assessed that this interest outweighs your interest in not having your personal data processed.

2. Customer service
When contacting our customer service, We may process the following categories of personal data about you:
i) name;
ii) address;
iii) phone number;
iv) e-mail; and
v) other personal data that you may provide to us, such as e.g. copy of identification for age control, taste and product preference and health information that you may provide to us e.g. in the event of a complaint.

Purpose: The above-mentioned categories of personal data are processed by us in order to handle matters received by our customer service.

Legal basis: The processing is based on our legitimate interest in being able to handle customer service matters as We have assessed that this interest outweighs your interest in not having your personal data processed. The processing may also be based on consent or that the processing is necessary for us to be compliant with a legal obligation.

3. Recruitment
In a recruitment procedure, We may process the following categories of personal data about you (and, where applicable, personal data regarding your submitted references):
i) name;
ii) address;
iii) phone number;
iv) personal identity number;
v) e-mail; and
vi) other personal data that you may provide, such as your photo, cover letter, credentials and contact information for references as well as their job title and company name.

Purpose: The above-mentioned categories of personal data are processed by us in order to handle recruitment procedures.
Legal basis: The processing is based on our legitimate interest in being able to handle recruitment procedures as We have assessed that this interest outweighs your interest in not having your personal data processed. The processing may also be based on consent or that the processing is necessary in order for us to be compliant with a legal obligation.

4. Suppliers, distributors, landlords, business partners etc.
When contacting suppliers, distributors, landlords, business partners and similar categories, including you who are employed by such parties (such as retail staff), We may process the following categories of personal data about you:
i) name;
ii) address;
iii) phone number;
iv) e-mail;
v) employer;
vi) where you operate;
vii) data that you register of completed trainings, and results in competitions, that We arrange;
viii) Sales data that you send to us; and
ix) other personal data that you may provide, such as personal identity numbers, bank details, digital calendar activities and information about sole proprietorship.

Purpose: The above-mentioned categories of personal data are processed by us in order to conduct our business e.g. through sales, marketing and collaboration with other parties.
Legal basis: The processing is based on our legitimate interest in conducting our business e.g. through sales and collaboration with other parties as We have assessed that this interest outweighs your interest in not having your personal data processed. The processing may also be based on consent or that the processing is necessary for us to fulfil a legal obligation or an agreement to which you are a party.

5. Visitors

When visiting our premises, We may process the following categories of personal data about you:
i) name; and
ii) time spent on our premises.

Purpose: The above-mentioned categories of personal data are processed by us in order to know who has access to our premises and for what period of time.
Legal basis: The processing is based on our legitimate interest in having information about how our premises are accessed and thus to be able to conduct our business in a secure and satisfactory manner. The processing may also be based on your consent.

6. Consumers
If you as a consumer participate in campaigns, events or competitions arranged by Helix, receive marketing from us, participate in market research activities that we administer or in other similar contexts are in contact with Helix, We may process the following categories of personal data about you:
i) name;
ii) telephone number;
iii) e-mail;
iv) your preferences regarding our products;
v) other personal data that you choose to share with us when you are in contact with us or participate in our market research activities.

Purpose: The above-mentioned categories of personal data are processed by us in order to carry out campaigns, events, competitions and similar events and to be able to target offers and marketing to you as a consumer. Furthermore, we carry out market research activities in order to develop and adapt our products.
Legal basis: The processing is in most cases necessary for Helix to be able to fulfil an agreement to which you as a consumer are a party. This is the case with promotions and competitions. Regarding events that We arrange, processing of personal data in connection thereto is based on our legitimate interest in marketing Helix and our brands. Processing of personal data in connection with other types of marketing activities and our market research activities may also be based on your consent.

7. Photographs
When visiting our events, either as a visitor or ambassador for our brand, We may photograph you and use the photographs for marketing purposes. The images may be used on our websites (group and subsidiary companies), in social media, presentation materials, brochure materials, and in exhibition booths. Your name may be published in connection with the publication of the images. In some cases, the images may be sent outside the EU/EEA, specifically to the USA, since Helix’s parent company is based in the USA. We may process the following categories of personal data about you in connection with using your photographs:

i) photographs; and
ii) name.

Purpose: The above-mentioned categories of personal data are processed by us for marketing purposes, for example in order to carry out campaigns, events, competitions and similar events.

Legal basis: The processing is based on our legitimate interest in conducting marketing activities e.g. campaigns, events or competitions. We have assessed that this interest outweighs your interest in not having your personal data processed.

Helix takes all reasonable steps to ensure that your personal data is processed and stored securely. Your personal data will never be stored longer than permitted by applicable law or longer than necessary to fulfil the above stated purposes. Your personal data will be processed by us for the time periods specified below. Thereafter, We will delete your personal data.

• Contact person for a company: Your personal data is saved for as long as you are an appointed contact person for a company doing business with Helix and during the period thereafter that Helix deems that the processing is necessary to maintain a business relationship.
• Customer contact: Personal data is stored during the time that Helix has contact with you as a consumer and during such period thereafter when it is possible for consumers to make legal claims against Helix. ID photos are saved only as long as required to identify the individual.
• Market research activities: Personal data processed within the scope of market research activities that we administer is stored for as long as it is necessary for us to analyse and process the results of the market research activities.
• Reseller and supplier agreements: Personal data in commercial agreements is stored during the term of the agreement and for 10 years thereafter.
• Correspondence with business partners: To the extent that the correspondence is relevant to a contractual relationship, the information may be stored during the term of the contract and for 10 years after the last obligation in the contract has been fulfilled, according to the above stated storage period for customer and supplier agreements. Correspondence that is not business-related is deleted on an ongoing basis.
• Potential distributors, suppliers and business partners: To the extent that the information is of relevance for a potential contractual relationship, personal data may be stored until any contact about such business relationship is terminated. Correspondence that is not business-related is deleted on an ongoing basis.
• Performance of a contract: Personal data (name, personal identity number, address, phone number, e-mail, billing and delivery information) which is submitted in connection with the order of products or services is stored as long as necessary in order for Helix’s performance of the agreement with you. This includes, inter alia, fulfilling delivery or warranty commitments.
• Communication: If you are in contact with Helix, e.g. by e-mail, your personal data is saved as long as it is necessary for us to answer your question and complete any follow-up inquiries.
• Job applicants: Helix saves your application documentation, including your resumé and cover letter, during the recruitment process and for a following period of two years, in order for us to defend potential legal claims. If a dispute is initiated or ongoing, relevant personal data is stored for as long as necessary for Helix to be able to defend itself in litigation proceedings.
• Personal data in log systems used by visitors: Personal data is stored for a week if there are no special reasons to save the data for a longer period, e.g. in criminal investigations.
• Legal obligation: Helix saves accounting information up to and including the end of the seventh year following the end of the calendar year in which the financial year to which the information relates was closed.
• Consent: In the event that We process your personal data based on your consent, We only save your personal data for as long as your consent is valid.

1. Group companies

We may share your personal data within Helix or with a company that is part of the same group as Helix for the purposes described in this privacy policy. In the event that such a group company is established outside the EU/EEA, point 4 below will apply.

2. Business transactions

Helix or a significant part of Helix may be sold to third parties. In such case, your personal data may be shared with the third party in connection with the sale. Such transfers of personal data may be carried out bases on Helix’s legitimate interest in being able to carry out a sale of its business.

3. Legal obligations

We may disclose your personal data to third parties in case of investigation of suspected crimes or if We are otherwise required by law or public authority decisions.

4. Business partners

In the event that We have a collaboration with a third party, for example when creating campaigns or market research activities regarding our products, our partner may, as part of its assignment as a processor for Helix or, as applicable, as separate data controller, collect personal data from you in cases where it is necessary for your participation in the campaign or the market research activity.

5. Transfers to a third country

As a general rule, your personal data will be processed within the EU/EEA. However, under certain circumstances, personal data may be transferred to countries outside of the EU/EEA. Helix is ​​part of an international group which entails that personal data may be transferred to group companies outside the EU/EEA, more specifically to the U.S where Helix’s parent company is domiciled. When such transfers are carried out, Helix takes all appropriate measures to ensure that your personal data is adequately protected and that all processing is performed in accordance with this privacy policy. This may include, for instance, that:

• the EU commission has decided that the receiving country ensures an adequate level of protection;
• Helix has collected your explicit consent prior to the transfer; or
• an agreement including certain standard contractual clauses issued by the European Commission (e.g. (EU) 2021/914) has been executed between Helix and the recipient, without any conflicting changes or amendments.

You have the right to obtain a copy of the security measures We take when transferring personal data to a country outside of the EU/EEA by contacting Helix on the contact details provided in Section I above. You can find more information about which countries are deemed to have an adequate level of protection on the European Commission’s website, and you can read more about the European Commission’s standard clauses here.

You have the right to:

• in accordance with Article 15 of the General Data Protection Regulation (GDPR) receive information from us as to whether or not We process your personal data. If We process your personal data, you can receive information regarding the purpose of the processing, the categories of personal data concerned, categories of recipient to whom the personal data have been or will be disclosed, the envisaged period for which the personal data is intended to be stored, your right to object, information as to the source of personal data where the personal data is not collected from the data subject and the existence of automated decision-making, including profiling;
• without undue delay, receive confirmation from us regarding rectification of inaccurate personal data and completion of incomplete personal data concerning you, according to Article 16 GPDR;
• without undue delay, receive confirmation from us of the deletion of your personal data, provided that further processing is not necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation or for the establishment, exercise or defence of legal claims, according to Article 17 GDPR;
• receive confirmation from us of restriction of processing where the accuracy of the personal data is contested by you, the processing is unlawful and you oppose the erasure of the personal data, We no longer need the personal data for the purposes of the processing but they are required by you for the establishment, exercise or defence of legal claims or if you have objected to the processing pursuant to Article 21 and subsequently Article 18 GDPR;
• receive personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, in accordance with Article 20 GDPR;
• withdraw your consent at any time in accordance with Article 7 section 3 GDPR. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal; and
• lodge a complaint with a supervisory authority if you consider that Helix’s processing of personal data infringes applicable law, in accordance with Article 77 GDPR. More information on how to submit a complaint to the Swedish Authority for Privacy Protection can be found here.

If We process your personal data based on our legitimate interest according to Article 6 section 1 lit. f GDPR, you have the right to object to the processing on grounds related to your situation or where the personal data is processed for direct marketing purposes in accordance with Article 21 GDPR.

If you want to withdraw your consent to the processing, in accordance with Article 7 section 3 GDPR, or object to the processing of personal data in accordance with Article 21 GDPR, you may send an e-mail to: info@onnicotine.se

Helix reserves the right to update and make changes to this privacy policy. The latest version of the privacy policy is always available on our website.