Privacy Policy

Information about our processing of personal data concerning consumers, customers and business contacts

This document contains information about the processing of personal data* carried out by Medvital, which is part of Medvital Sverige AB. The company in question is referred to below as "Medvital", "we" or "us".

*"Personal data" means information that can be linked to you as an individual.

The purposes of our processing of personal data, types of personal data, legal basis and retention period.

1.1 Our processing of personal data takes place within the framework of Norwegian legislation, including the Personal Data Act and the General Data Protection Regulation (GDPR). In short, the purposes of Medvital's processing of personal data are to handle inquiries from consumers and others, to provide services or products, to manage or tailor communication and marketing, to adapt and improve product development and the production of services or products, or to manage cooperation and communication with business contacts. A more detailed description follows below.

1.2 The purpose of our use of personal data and information about which types of personal data we will use

is apparent either from information we have provided to you;
is clear from the context of your contact with us (for example, if you provide your name and email address when registering to receive newsletters);
or is described in sections 1.4 – 1.10 below.

1.3 In sections 1.4 – 1.10 below, you will find more information about our processing of personal data in various situations where you have been in contact with us. The information describes the specific purposes for which your personal data is processed, which categories of personal data Medvital processes, on which legal basis Medvital bases the processing, and how long Medvital stores the personal data.

Please note that several of the items of information may be relevant to you simultaneously, for example if you visit our website (item 1.4) and purchase goods (1.7) and, in connection with the purchase, create a profile in our customer club, where applicable (1.6).

1.4 Visits to our websites – Cookies and similar technologies ("cookies")

1.4.1 Medvital's websites use cookies and similar technologies (hereinafter collectively referred to as "cookies") that are stored on your computer, mobile phone or tablet, usually through the use of a web browser. Cookies are used, among other things, to ensure secure login, to give visitors a better user experience, to provide access to various website functions, to distinguish visitors to the website from one another, to analyse how well our website and online services function, and to be able to carry out customised, interest-based advertising. This involves a greater or lesser degree of use of the personal data of website users – as described below – and helps us to improve the website and make our digital communication more relevant to recipients.

Type of personal data processed with cookies: IP address, type of device and operating system, location, website behaviour, clicks, time spent on the website, etc.
Purpose	Legal basis	Retention period
Performance-based cookies: These allow us to count visits and traffic sources so that we can measure and improve the performance of our website. They help us know which pages are the most and least popular and to see how visitors navigate around the website. All information that these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies, we will not know when you have visited our website.	Your consent	See 1.4.4 (below the table)
Functional cookies: These enable the website to provide enhanced functionality and personalisation. They may be set by us or by third-party service providers whose services we have added to our websites. If you do not allow these cookies, then some or all of these services may not function properly.	Your consent	See 1.4.4 (below the table)
Necessary cookies: These are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you, which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but this will likely cause some parts of the website not to work. These cookies do not store any personally identifiable information.	Medvital's legitimate interest in ensuring that our websites function for visitors.	See 1.4.4 (below the table)
Targeting cookies: These are set by our advertising partners. They may be used by these companies to build a profile of your interests and show you relevant advertisements on other websites. They do not store personal information directly, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.	Your consent	See 1.4.4 (below the table)

1.4.2 Visitors may voluntarily choose to accept the use of cookies, through settings on our website or in their browser. You can change the settings in your browser so that you either block cookies from being downloaded automatically or so that you are given a choice to download each cookie. You can also delete cookies at any time by going to the settings in your browser. How this is done depends on which browser you use. See the "Internet/Privacy options" menu or the equivalent in your browser for further instructions on how your browser works. Please note that if you decline cookies, this may affect the functionality of our websites as well as other websites.

1.4.3

1.4.4 If you would like more information about the cookies that may be used by this website, what they are used for, third-party access to information collected by cookies and how long they are used, you can find a list of specifications in the cookie information box that you have access to when you enter the website, under "Cookie settings", or in the form of a clickable shield icon, usually available at the bottom left, when you visit our website.

1.5 Competitions and other promotions

Type of personal data: Full name, email address, telephone number, date of birth, answers or other notes in connection with the competition, e.g. a photo of yourself, etc.
Purpose	Legal basis	Retention period
Managing your participation in the promotion, including contacting you if you win.	Necessary in order to perform a contract with you (participation in the promotion). In some cases, you have also given your consent at the time of registration.	The data will be deleted within a reasonable time after the promotion has ended. The time of deletion may be specified in the promotion terms.
Publication of winners of a promotion/competition on the website or on social media	Your consent	The data will be published for as long as the publication is considered relevant to the Medvital company's marketing of the competition, but we will stop publishing the information if you withdraw your consent.

1.6 Loyalty programmes or customer clubs as well as subscriptions to newsletters and offers from us

Type of personal data: Full name, age, gender, email address, address, telephone number, date of birth, information about which goods or services you have purchased in our online stores and the time of the purchase, your consent to communication from us and the history of this.
Purpose	Legal basis	Retention period
Administering membership in customer clubs, loyalty programmes or subscriptions to newsletters and offers, which provide access to offers and other information about our products.	Necessary in order to perform a contract with you. In some cases, you have also given your consent at the time of registration.	The information is used until you withdraw your consent or up to 12 months after you cancel your subscription or membership. For customers with active loyalty points, we store customer data for up to 36 months.
Sending newsletters and offers to members of customer clubs or loyalty programmes, or subscribers to newsletters and offers.	Necessary in order to perform a contract with you. In some cases, you have also given your consent at the time of registration.	The information is used until you withdraw your consent or up to 12 months after you cancel your subscription or membership. For customers with active loyalty points, we store customer data for up to 36 months.
Personalisation of the content of newsletters and offers so that the message matches your assumed preferences regarding our products and offers. The customisation is based on data that you have provided to us in connection with registration etc., as well as which products you have purchased in our online stores and the times of purchase.	Medvital's legitimate interest in effective marketing. In some cases, you have also given your consent at the time of registration.	The information is used until you withdraw your consent or up to 12 months after you cancel your subscription or membership. For customers with active loyalty points, we store customer data for up to 36 months.
Personalisation of the content of newsletters and offers from Medvital so that the message matches your assumed preferences regarding our products and offers. The customisation is based on data that you have provided to us in connection with registration etc., as well as what you have purchased in our online stores and the times of purchase, as well as information from third parties, which enables us to predict which products you may be interested in, such as (i) assumed income, interests and family situation, (ii) which web pages you have visited and advertisements you have clicked on, (iii) your clicks in our newsletters	Your consent	The information is used until you withdraw your consent or up to 12 months after you cancel your subscription or membership. For customers with active loyalty points, we store customer data for up to 36 months.
Your accumulated bonus points or similar, in order to be able to give you various benefits.	Necessary in order to perform a contract with you.	Deleted within 36 months after you end your subscription or membership.
Based on your purchase of products in our online store, we may tailor the display of advertisements on the internet to other people with similar characteristics/interests to yours.	Medvital's legitimate interest in effective marketing.	Deleted within 36 months after you cancel your subscription or membership, or when you request that the use of your data in this way be discontinued.

1.7 Purchase of goods or services from us in online stores or via telephone sales

Type of personal data: Full name, email address, address, telephone number, purchase and delivery history, date of birth, the product's placement in the shopping cart on the website
Purpose	Legal basis	Retention period
Administration of the user account in the online store, which involves storing contact details and your orders.	Necessary in order to perform a contract with you. Medvital's legitimate interest in providing good customer care.	The information is stored until you delete your user account, where applicable.
Handling of orders for the purchase of goods or services and the delivery thereof, sending order confirmations to you and following up on any complaints.	Necessary in order to perform a contract with you, and to fulfil your rights under the Sale of Goods Act and our obligations.	For customers with a registered customer profile/account: Information about ongoing and previous purchases is kept until you request that it be deleted, or within 36 months after you end your subscription or membership.
Storage of accounting information about delivery	That Medvital must fulfil a legal obligation	The retention period follows from accounting legislation.
If you have logged in as a user in one of Medvital's online stores and have products in your shopping cart without completing your shopping or checkout, we may save your shopping cart information so that we can send you an email reminding you of your cart at a later time. This will only happen if you are a member of a customer club or loyalty programme, or subscribe to newsletters and offers, see 1.6.	Legitimate interest in the sale and marketing of our products	Deleted within three months.
Use of purchase information in the analysis of purchasing trends, for personalisation of communication, advertising and inventory.	Medvital's legitimate interest in effective communication with consumers.	Only anonymised data is used (see 2.2).
Marketing and sale of our products by telephone	Medvital's legitimate interest in the sale of products	The information is used for up to 12 months until you cancel your subscription or membership or you request that we stop contacting you with telemarketing. For customers with active loyalty points, we store customer data for up to 36 months.

1.8 Inquiries to us about our products, services or operations

Type of personal data: Full name, email address, telephone number, the content of the inquiry to Medvital
Purpose	Legal basis	Retention period
Handling of inquiries regarding information, guidance, complaints, claims, etc.	Medvital's legitimate interest in good customer care. To perform a contract with the consumer who is making the inquiry. In some cases, the processing of personal data may be necessary in order to fulfil a legal obligation incumbent on the Medvital company, for example to handle a complaint or to record payment information in accordance with the Accounting Act.	We delete personal data related to inquiries and complaints in accordance with the retention rules for customer data mentioned in 1.6 and 1.7.
Use of inquiries to adapt Medvital's products, services or marketing.	Medvital's legitimate interest in providing good products, services and marketing.	We delete personal data related to inquiries and complaints in accordance with the retention rules for customer data mentioned in 1.6 and 1.7.
Use of inquiries in connection with product recalls.	Medvital's legitimate interest in providing good products. In some cases, the processing may be necessary for security reasons, in particular to protect people's lives and health.	We delete personal data related to inquiries and complaints in accordance with the retention rules for customer data mentioned in 1.6 and 1.7.
Processing of other inquiries	Medvital's legitimate interest in good customer care.	We delete personal data related to inquiries and complaints in accordance with the retention rules for customer data mentioned in 1.6 and 1.7.

1.9 Participation in market research surveys

Type of personal data: Full name, email address, telephone number, age, your market research answers

Purpose

Legal basis

Retention period

Market research via email or other electronic channels.

The purpose is to improve our products and our marketing.

Consent or a contract with you (membership) gives us the basis for the inquiry.

The processing of your answers is based on our legitimate interest in improving our own products and our marketing

The answers are anonymised immediately (see 2.2).

1.10 Other processing of personal data concerning our business contacts

Type of personal data: Full name, email address, telephone number, position, communication, participation in meetings with us, input at meetings, business observations and reviews, image, audio and film recordings, allergies, findings in anti-corruption and compliance screenings, results in anti-corruption and compliance checks.
Purpose	Legal basis	Retention period
Handling of dialogue, inquiries and meetings, as well as minutes, notes, recordings and transcription of contact and communication, for example meetings.	The processing may be necessary in order to perform a contract with your company or to carry out tasks prior to such a contract. The basis may also be our legitimate interest, e.g. to: (i) improve our goods, services, production, or other parts of our operations (ii) carry out strategic business assessments and decisions; (iii) ensure good cooperation and customer care. The basis for processing recordings from Teams meetings and similar is usually consent. Information about allergies will be handled with consent.	As long as there is a business need for storage.
In order to ensure regulatory compliance with sanctions rules, as well as to ensure compliance with anti-corruption rules, Medvital may carry out a review of external third parties with whom Medvital and its business units have or will establish relationships. Personal data will also be cross-referenced against sanctions and fraud databases for this activity. An example of such databases is Bureau van Dijk, which will obtain the results on our behalf and may disclose information about the criminal records of the executives and persons in senior positions or board positions of our corporate customers. For information about how Bureau van Dijk processes personal data, click here.	We have a legitimate interest in carrying out the processing for the purpose of fulfilling our regulatory and compliance obligations and to ensure that our counterparties are within acceptable risk (to the extent that your interests, fundamental rights or freedoms do not override such legitimate interest).	In most cases, no storage of personal data will take place. However, personal data may be stored under special circumstances for as long as is deemed necessary to document compliance with laws and regulations, or for reasons of contractual liability.

Deletion and anonymisation

2.1 Personal data will be deleted after the retention period specified in the tables in sections 1.4 – 1.9.

2.2 As an alternative to deletion, we may remove identifying information from the personal data so that the data can no longer be linked to you (anonymisation). This may, for example, be relevant when using the information in our experience archive and to compile analyses and statistics, as well as to adapt and develop Medvital's marketing and products to consumers' wishes and needs.

Processing of personal data via third parties

3.1 Medvital may use third parties (data processors) to process your personal data. Our use of data processors is governed by data processing agreements that we enter into with such parties, in accordance with applicable legislation.

3.2 Personal data will normally be stored in, and processed from, countries within the European Economic Area (EEA).

3.3 In certain cases, Medvital may enter into agreements with data processors in third countries (countries outside the EEA). In such cases, the basis for the transfer will be one of the following:

The country is approved by the EU Commission under an adequacy decision, which means that the country safeguards personal privacy in a manner equivalent to that required for countries within the EEA; or
Medvital has entered into an agreement with the data processor on the basis of standard data protection clauses adopted by the European Commission (please contact us via the form in section 4.1 if you would like a copy of these); or
Another approved basis for the transfer.

3.4 In the case of processing under points ii) or iii) above, Medvital assesses the level of protection in the third countries where personal data is processed. If it proves to be necessary, Medvital will take additional measures to ensure that the level of protection for personal data is equivalent to that required of data processors within the EEA.

Your rights – Contact points at Medvital.

4.1 Introduction – and contact points for exercising your rights

If you want to update or withdraw your consents, or want to view, correct or delete your personal data in connection with a service from us, e.g. newsletters via email, a user in an online store or customer club, you can make such changes on "my page" etc., or click on the link at the bottom of the newsletter.

If you want to exercise other rights that you have in connection with our processing of your personal data – see sections 4.2 to 4.8 below – please contact us by sending an email to gdpr@Medvital.se.

4.2 Right to rectification

You have the right to have inaccurate personal data about you rectified without undue delay, and to have incomplete personal data completed.

4.3 Right to erasure

You have the right to have personal data about you erased without undue delay in the following cases:

the personal data is no longer necessary for the purposes for which it was collected or processed,
if you withdraw the consent on which the processing is based and there is no other legal basis for the processing,
you object to the processing and Medvital does not have any legitimate interests in the processing that outweigh your interest in it ceasing (see point 4.7 below), or
the personal data has been processed unlawfully.

However, Medvital is not obliged to erase your personal data if it is necessary for Medvital to be able to continue processing your personal data in order to fulfil obligations under national legislation or to establish, exercise or defend legal claims.

4.4 Right to withdraw consent

You have the right to withdraw your consent if this is Medvital's legal basis for processing your personal data. In such cases, Medvital will cease such processing of personal data.

4.5 The right of access and data portability

You have the right to obtain information about whether Medvital processes personal data about you. If so, you have the right to information about the processing, including which personal data is stored and how it is processed. You will receive this information free of charge, unless the request is repeated. In that case, Medvital may charge a reasonable fee for processing the request.

You have the right to receive personal data that you have provided to Medvital in a structured, commonly used and machine-readable format, and have the right to have this data transmitted to another data controller, provided that the processing is based on consent or a contract and that the processing is carried out automatically.

4.6 The right to restriction of processing

You have the right to require that the processing of your personal data be restricted in the following cases:

you contest the accuracy of the personal data and the restriction will then apply for a period that enables Medvital to verify the accuracy of the personal data,
the processing is unlawful, you oppose the erasure of your personal data and instead request that the use of your personal data be restricted;
Medvital no longer needs the personal data for the purpose of the processing, but you need it to establish, exercise or defend legal claims, or
you have objected to the processing of personal data pending verification of whether Medvital's legitimate interest in the processing outweighs your interest in the processing ceasing.

If the processing of your personal data has been restricted, such personal data shall, apart from storage, only be processed with your consent or to establish, exercise or defend legal claims or to protect the rights of another person. If the processing of your personal data has been restricted, Medvital shall notify you before the restriction of processing is lifted.

4.7 Right to object

You have the right to object to the processing of personal data about you that is based on Medvital's legitimate interests. In such a case, Medvital will cease the processing of your personal data, unless Medvital's legitimate interest in the processing outweighs your interest in the processing ceasing or if the processing is necessary to establish, exercise or defend legal claims.

You also have the right to object to Medvital's use of your personal data for direct marketing. If you exercise this right, Medvital will cease such use of your personal data.

4.8 The right to complain about our processing of your personal data

If you believe that we have not fulfilled the rights you have in relation to the personal data we process about you, we would appreciate it if you contact us via the form in section 4.1. You can request that your request be assessed by Medvital's legal team by stating this in your inquiry to us.

You also have the right to complain about Medvital's processing of your personal data to the relevant supervisory authority.

Changes to the privacy policy

Medvital may adjust and adapt this privacy policy. You can visit this page yourself at any time and check whether any updates have been made. This privacy policy was last updated as published at the top of the page.