Why a privacy policy?

Xintela values your personal privacy. We therefore always strive to protect your personal data in the best possible way and to comply with the laws and regulations on personal data protection applicable at any given time. Through this privacy policy, we want to inform you about how your personal data is processed by Xintela. This policy will, among other things, help you understand what kind of information Xintela collects and how it is used.

Who is responsible for your personal data

Xintela AB (Publ), corporate identity number 556780–3480, with address Medicon Village, 223 81 Lund, is responsible for the processing of your personal data. Xintela is the data controller for the processing of your personal data and is therefore responsible for ensuring that your data is handled in a correct and secure manner in accordance with applicable legislation.

Personal data in Xintela’s research

For you who have personal data registered with Xintela for research purposes.

When personal data is to be processed, the data subject must have given their consent to the processing, or the processing must be necessary for the performance of a task carried out in the public interest.
As a general rule, it is prohibited to process sensitive personal data, for example data revealing racial or ethnic origin, political opinions, religious beliefs, and data concerning health or sex life. However, there are exceptions in the law.
One exception is if the data subject has given their explicit consent. Another exception is for research purposes if the processing has been approved in accordance with the Act concerning the Ethical Review of Research Involving Humans (the Ethical Review Act). In addition, sensitive personal data may be processed for statistical purposes, without the data subject’s consent, if the processing is necessary for the performance of a task carried out in the public interest and if the public interest in the research in question clearly outweighs the risk of undue intrusion into the data subject’s personal privacy. If the processing has been approved by an ethics review board, these conditions are considered to be fulfilled. It is not permitted to collect sensitive personal data in a separate database for research or statistical purposes that have not been determined at the time of collection.

Ethical review

All research involving the processing of sensitive personal data or data relating to criminal offences must undergo ethical review. The ethical review is carried out by an ethics review board with representatives of both the public and research, and it covers both the research project itself and the processing of personal data in accordance with the Personal Data Act. The starting points for the review are set out in the Ethical Review Act, where the research ethics review shall constitute a sufficient guarantee that sensitive personal data is processed for research only in the exceptional cases where a certain intrusion into personal privacy is truly justified.
The ethics review board does not need to apply the balancing test that normally applies, i.e. that the public interest must clearly outweigh the risk of intrusion into individuals’ personal privacy that the processing may entail. However, how the balancing test is normally applied may serve as guidance for the boards’ assessment.

Personal data for direct marketing

For you who have personal data registered with Xintela for marketing purposes.
Your personal data may be used for direct marketing, newsletters, customer surveys and for statistical purposes and may be used for mailings by post or e-mail to you until you withdraw your consent. The sender of the mailings is Xintela AB (Publ).

Personal data for recruitment

For you who have submitted personal data for registration with Xintela for recruitment purposes.

Xintela will process your personal data during the recruitment process and for future career opportunities. Xintela will contact you if a matching position becomes available. When you submit your CV to us, you simultaneously give your consent for your CV to be archived at Xintela for a maximum of one year, after which it will be deleted. You may contact us at any time and request that we delete your personal data.

Personal data that we process about you

Personal data that you have provided to us

‍We collect and store information about you that you yourself provide to us.

Personal data that we have collected from you

‍For tissue donation and for research purposes, Xintela collects various personal data from you, depending on the study and its scope. Everything is done in accordance with your consent.

Personal data that we have collected from third parties

Xintela collects personal data from third parties regarding shareholder information. This information comes from Euroclear Sweden AB.

How we use your personal data

Xintela uses personal data for the following categories:

• Newsletters and other marketing
• Shareholder information
• Recruitment needs
• Research purposes
• Employees
• Investors
• Partners
• Customers
• Tissue donors

Depending on the circumstances under which your personal data has been registered with Xintela, you may appear under one or more categories.

Legal basis for our processing

‍The processing of personal data by Xintela AB (Publ) takes place on the following legal bases

• In order for Xintela to be able to fulfil its agreement with you
• Legal obligation – personal data processing in order to fulfil requirements imposed by, for example, the Medicinal Products Act, the Act on the Handling of Human Tissues and Cells, the Accounting Act, the Companies Act, the Value Added Tax Act and the Consumer Sales Act constitutes the legal basis for processing based on a legal obligation. See also the section “Personal data in Xintela’s research” above.
• Balancing of interests – if the processing of personal data is necessary for the performance of a task carried out in the public interest and if the public interest in the research in question clearly outweighs the risk of undue intrusion into the data subject’s personal privacy.

Who may gain access to your personal data?

Your personal data will not be transferred or sold to third parties. However, your personal data may be disclosed to third parties (data processors) if this is required in order to provide services to you.

We disclose your personal data to the following;

• Suppliers of IT systems for development and support. These companies provide services, technical solutions and platforms for Xintela’s research programmes.
• Partners who handle marketing.
• We only send the data that is needed.
• Any authorities in accordance with legal requirements.

How we protect your personal information

‍Xintela AB (Publ) takes the technical and organisational security measures required by law to ensure that your personal data is not manipulated, lost or destroyed, or that unauthorised persons gain access to it. Our security procedures are constantly evolving in line with technological developments.

Where is your data stored?

Xintela AB (Publ) stores all personal data collected from you within the EU and EEA. We do not disclose personal data to third parties, except in situations where this is a requirement arising from a statutory obligation or in order to fulfil our commitments to you. See more information under the section “Who may gain access to your personal data”.

How long do we retain your data?

When you provide your personal data to Xintela AB (Publ), you give your consent for Xintela to register and process the stated data for the purposes mentioned above.
We never process your personal data for longer than is permitted under applicable law, regulation, practice or authority decision. Data may, for example, be retained longer if required under the Ethical Review Act, the Medicinal Products Act, the Act on the Handling of Human Tissues and Cells, the Consumer Sales Act or the Accounting Act. The personal data is stored and processed in Xintela’s IT systems. You may contact us at any time and request that we delete your personal data, which will then be done immediately unless this conflicts with applicable law at the time. If applicable law at the time does not allow your personal data to be deleted but it is instead possible to anonymise your personal data, this will be done.
In other situations, your personal data is not retained longer than necessary for the specific purpose.

Your rights

You have the right to request access to your personal data and to obtain information inter alia about which personal data is stored with us, the purposes of the processing of such personal data, the recipients or categories of recipients to whom the personal data has been or will be disclosed, the envisaged period or the criteria used to determine the period for which the personal data will be stored. You may contact us at the address below and request that the information be sent by post or e-mail. For your security, this information is only sent to your registered address or the e-mail address stated in our customer database.
If you consider that the personal data that Xintela AB (Publ) has processed is incorrect or has been processed in breach of applicable legislation, you also have the right to request that such personal data be rectified, blocked or erased. You do this by contacting us. Xintela AB (Publ) is in certain cases obliged by law to process your personal data even if you have requested that it be erased.
If you wish to have the personal data you have provided transferred in order to be able to use it elsewhere (data portability), we ask you to contact us at the address below.
If you consider that your personal data has been processed in breach of applicable legislation, you always have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten).

Links to other pages

Xintela.se may contain links to external websites over which Xintela does not exercise decisive influence. These are not covered by this policy.

Contact details

If you have questions about how we handle your personal data or if you wish to change or transfer your data, please contact gdpr@xintela.se. Regarding the handling of personal data, you may also speak with the Swedish Authority for Privacy Protection, which is the supervisory authority for this handling.
Address:
Xintela AB (Publ)
Medicon Village
223 81 Lund
info@xintela.se
‍‍
^{Xintela AB – Ver 2.1 2022-09-22}