Brunswick Real Estate Privacy Policy
1. General
This General Data Privacy Policy (the "Privacy Policy") sets out the general commitment of Brunswick Real Estate AB and its subsidiaries and affiliates located e.g. in Sweden, Luxembourg, U.K., Estonia and Finland (together, "Brunswick Real Estate") when collecting, using, disclosing, transferring and otherwise in any way using information directly or indirectly relating to an identified or identifiable natural person, or that otherwise qualify as personal data under applicable legislation ("Personal Data"), such as name, telephone number and email.
The Privacy Policy also contains certain instructions to you as an employee in relation to the processing of Personal Data and on how you should react in certain situations related to the use of Personal Data.
Brunswick Real Estate is committed to fulfil the highest standards in relation to personal integrity. Brunswick Real Estate must only process Personal Data in accordance with applicable data protection legislation, in a transparent manner and in accordance with data subject's expectations.
Please note that this Privacy Policy is of a general nature and any closer details of specific processing is set out in more specific information policies for different functions within Brunswick Real Estate as set out under Section 10 below, and available at Brunswick Real Estate internal folder \\leimdorfer.local\IM\Gemensam.
2. For what purposes may Personal Data be processed?
Brunswick Real Estate must only process Personal Data of registered persons (the "Data Subjects") for lawful, explicit and specified purposes as approved by management. The Data Subjects shall, to the extent possible but always as required under applicable legislation, be informed of such purposes in advance together with all other information that is required for the Data Subjects to become aware of how their Personal Data is processed and to enforce their rights in relation to Brunswick Real Estate. As an employee of any of the affiliates of Brunswick Real Estate you must always ensure that such information is provided if you are involved in a process that includes collecting or other usage of Personal Data.
In summary, without limitation, Brunswick Real Estate may use Personal Data to the extent required to fulfil the following purposes:
to fulfil agreements entered into with service providers, suppliers, employees, consultants, tenants, investors and other contracting parties; to provide important information about Brunswick Real Estate to shareholders and investors, such as annual and quarterly reports, invitations to investor meetings, and requests for investor consents; to provide information, products and services which have been requested from Brunswick Real Estate; to provide information about investments to existing and potential investors which we think may be of interest; to comply with any legal or regulatory obligations, requirements or requests; or to protect, defend or enforce our legal rights, or those of others.
The above purposes are more specified in the Brunswick Real Estate's Records of Processing of personal data that is administered by the persons that are responsible for how Brunswick Real Estate process personal data. If you have any questions, you can contact us here: privacy@brunswickrealestate.com
Before Personal Data is processed for a purpose, the relevant processing must be analyzed and approved by management.
3. What types of Personal Data may be processed?
Brunswick Real Estate may process the following categories of Personal Data: employees – included but not limited to identification details such as name, personal identification number, passport and photos, contact details such as home address, telephone numbers and email address and information related to the work position such as employee biography/resume, personal statement and academic records, account details such as salary payment details and bank account information, details on personal trading in shares and other financial instruments. For further information, please refer to Section 10 below; potential candidates for recruitment – included but not limited to identification details such as name, personal identification number, photos, contact details such as home address, telephone numbers and email address and information related to the current and potential work position such as employee biography/resume, personal statement, cover letter and academic records. For further information, please refer to Section 10 below; board members - included but not limited to identification details such as name, personal identification number, passport and photos, contact details such as home address, telephone numbers and email address; investors – included but not limited to identification details of representatives and contact persons such as name, personal identification number and/or passport details and photos, contact details such as telephone number, postal address and email address to contact persons of investors as well as account details and/or other financial information. For further information, please refer to Section 10 below; tenants – included but not limited to identification details of tenants or their representatives, such as names and personal identification number and/or passport information, contact details such as postal address, email address, rent information such as rental level and records relating to rent payment, bank details such as account number. For further information, please refer to Section 10 below; suppliers/service providers – included but not limited to identification details such as names and photos, contact details of service providers or their representatives, such as telephone numbers, email address, postal address and account details such as payment information and bank account details; and other external contacts such as advisors, consultants and property brokers – included but not limited to contact details of other external contacts or their representatives such as name, postal address, email address and telephone numbers, evaluation details such as evaluations of consultants for their suitability in specific projects for Brunswick Real Estate, and account details such as payment information and bank account details. Please note that data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or sex life and sexual orientation must never be processed and that data concerning health and trade union membership may only be processed for employment related purposes when allowed under applicable legislation and by specifically authorized employees.
4. Security of the Personal Data
Brunswick Real Estate is committed to process Personal Data in a manner that ensures an appropriate level of security for the Personal Data. Thus, Brunswick Real Estate uses technical, administrative and organizational security measures that are appropriate to the risk of the processing to protect the Personal Data against unauthorized access, destruction, accidental loss, alteration, blocking, copying, distribution, unauthorized disclosure or access, and against all other unlawful or unauthorized Personal Data processing.
Security measures implemented include firewalls and password protection.
However, it is important that you as an employee at all times remain careful as to how you use your IT equipment and devices in order to minimize the risks related to the security of personal data. Please consult Brunswick Real Estate's IT-responsible for further information.
Only authorized employees holding a position where it is necessary to process Personal Data to fulfil a working task, must be granted access to the relevant Personal Data.
If you for any reason have access to Personal Data that you do not need access to in order to fulfil your tasks, please immediately inform: privacy@brunswickrealestate.com
All Personal Data is considered confidential information and is subject to the employee confidentiality undertaking as set out in the employment agreements.
5. Data protection impact assessments
A Data Protection Impact Assessment ("DPIA") is a process that helps an organization identify, assess and manage privacy risks in relation to new systems and projects involving the Processing of Personal Data. A DPIA must also be used when changes are made to existing policies and processes or if an aspect of Brunswick Real Estate's infrastructure is modified where Personal Data is stored/managed or otherwise processed. At a high level, a DPIA presents an overview of the privacy risks, an assessment of the gravity of that risk and possible measures that can be undertaken to manage and/or eliminate those risks. The DPIA also takes into account scenarios where a privacy risk cannot be mitigated or eliminated.
Please contact privacy@brunswickrealestate.com, to inquire whether a DPIA must be conducted if you are to be involved in a new project, or system or if other initiative or changes to an existing system, practice or initiative will involve the Processing of Personal Data.
6. Reporting a data breach
If you at any time become aware of that a breach of security has occurred that may have resulted in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed, you should immediately inform privacy@brunswickrealestate.com that you have identified a potential data breach and await further instructions, Please do not provide any details other than that as a first step.
7. Administration, Rectification, Deletion, Retention and Data portability
Brunswick Real Estate must only process Personal Data that is adequate, relevant and limited to what is necessary to fulfil the purpose of the relevant processing. When the purpose is fulfilled, Brunswick Real Estate will as soon as possible delete the Personal Data unless there is any legal requirement to retain the Personal Data for a longer period or the Personal Data must still be processed for another purpose, such as to fulfil a contractual obligation (in which case it will be stored but only used for such other purpose).
A Data Subject has always the right to request access to the Personal Data relating to him or her. This right of access includes the right to receive information on the type of Personal Data being processed, the purpose of such processing and the recipients or category of recipients that personal data has been transferred to. A Data Subject also has the right to rectify or complete Personal Data if the Personal Data is inaccurate or incomplete.
As soon as Brunswick Real Estate becomes aware of any inaccurate Personal Data being processed, Brunswick Real Estate will always rectify such Personal data without undue delay.
The Data Subject also has the right to request erasure of his or her Personal Data in certain events and the right to be provided with any Personal Data, which is being processed by automatic means, in a structured, commonly used and machine-readable format and/or that such Personal Data is transmitted to another controller.
A Data Subject has also the right to object to certain use of Personal Data and to require the use of personal data to be restricted if the Personal Data is inaccurate, unlawful or no longer necessary.
If you as an employee receive any request from a Data Subject as to the processing of his or her Personal Data, you must always immediately forward such request to privacy@brunswickrealestate.com, and await further instructions.
8. To what third parties may Personal Data be transferred?
Personal Data should never be disclosed to any unauthorized third parties. However, Personal Data must under certain circumstances be shared with third parties, but only to such parties to which there is a legal ground to do so. The below provides a summary of the third parties that Brunswick Real Estate may provide Personal Data to.
Before Personal Data is disclosed to any third party you should always contact privacy@brunswickrealestate.com, for approval.
Group Companies
Brunswick Real Estate consists of the parent company Brunswick Real Estate AB, established in Sweden, with operational affiliates in different countries. Personal Data may be shared within Brunswick Real Estate to the extent necessary to fulfil a purpose and to the extent allowed under applicable data protection legislation.
Service providers Brunswick Real Estate also uses third party service providers ("Service Providers") outside Brunswick Real Estate. The Service Providers perform certain services as requested by Brunswick Real Estate, which may involve the processing of Personal Data. Such services include the provision of consultancy services, valuation services, insurances services, bank services, hotels services, marketing services and IT services. A Service Provider must only process Personal Data to enable the Service Provider to perform the services requested by Brunswick Real Estate. Only Personal Data that is necessary to fulfil the relevant purpose must be provided to the respective Service Providers.
The Service Providers that are acting on behalf of Brunswick Real Estate, and where only Brunswick Real Estate decides the means and purposes of the use of Personal Data (thus the Service Provider is a data processor), must always be obliged, under a written agreement, to follow the instructions of the relevant controller within Brunswick Real Estate. Such agreement must impose obligations on the Service Provider to act in accordance with Brunswick Real Estate's instructions, to follow applicable law and to implement appropriate technical and organizational measures for the protection of the Personal Data.
No Service Providers that may come to process Personal Data may be engaged unless a data processor agreement has first been negotiated and approved by management. For further information please email your request to: privacy@brunswickrealestate.com
Cooperation partners and investors Brunswick Real Estate may provide Personal Data to cooperation partners, investors and suppliers to the extent required to enter into investment agreements, managing existing investors and real estate companies, valuation of property/assets and marketing to current and potential investors.
Authorities Brunswick Real Estate may also be required to provide Personal Data to relevant authorities (e.g. the police, financial supervisory authorities, social insurance agencies, and tax authorities) based on mandatory law and in order to fulfil legal obligations. Brunswick Real Estate may also be required to provide Personal Data to foreign authorities according to its undertakings under foreign laws (know-your-client regulations).
Never transfer Personal Data to any third party unless approved by management.
9. To what countries may Personal Data be transferred?
Brunswick Real Estate operates on a global basis. This means that Personal Data may be transferred to several different countries. Furthermore, Brunswick Real Estate also has Service Providers and cooperation partners, both within and outside the European Union and the European Economic Area (the "EU/EEA"). Brunswick Real Estate must always ensure that transfer of Personal Data to different countries has a legal basis and that it is adequately protected by the receiving parties in such countries. Adequate protection may typically be to impose on the receiving party contractual obligations that ensure that such party maintains the same high level of privacy and data security as practiced by Brunswick Real Estate. Further information or a copy of the safeguards that Brunswick Real Estate have in place to ensure lawful transfer of the Personal Data is available in the more specific policies set out below.
10. Further Information and Contact Details
This Policy only sets out the general principles on Brunswick Real Estate's processing of Personal Data. For further information and policies please email your request to: privacy@brunswickrealestate.com
IT Security Policy; CRM System Policy; Data Retention Policy; Employee Privacy Notice; Privacy Notice for Tenants; Privacy Notice for Investors; Privacy Notice for Debt Investors; Privacy Notice for Debt borrower; External Privacy Policy; Data Privacy Impact Assessment ("DPIA") Policy and Pre-screen DPIA
The individuals responsible in respect of Personal Data processing of Brunswick Real Estate can be reached at the following email-address: privacy@brunswickrealestate.com
11. Updates to or Non-Compliance with this Policy
In order to ensure compliance with the applicable data protection legislation, as amended from time to time, this Policy may be amended by Brunswick Real Estate at any given time.
It is important that Brunswick Real Estate and its employees at all times ensure compliance with this Policy and the applicable data protection legislation. Any breach of the Policy shall be reported to Brunswick Real Estate's data protection responsible individuals, at the following email address: privacy@brunswickrealestate.com
Last updated: 23-05-2018
