This Privacy Notice describes how Nextory AB, reg. no. 556708-4149 (“Nextory”, “we”, “our” or “us”) collects, uses, shares or otherwise processes personal data and the rights associated with that processing.
This Privacy Notice applies to the processing of your personal data if you are a representative of a supplier, publisher, licensor, business partner, consultant or other business contact of Nextory where your information has been shared with us in our capacity as a controller (“you” or “your”). Nextory is the controller under EU data protection laws regarding the processing of your personal data.
We care about your privacy and it is important to us that you feel comfortable with how we process your personal data. Therefore, please read the information in this Privacy Notice carefully.
Processing of your personal data
We collect and process the personal data you submit to us in connection with your interactions with us. In addition, personal data may be collected from other sources, such as your employer or the organisation you represent, or from publicly available sources. The following table describes (i) the purposes for the processing of your personal data; (ii) which types of personal data we collect and process for each purpose; (iii) the legal basis under the GDPR for the processing of your personal data; and (iv) for how long we process your personal data for each purpose.
| Purposes of the processing of your personal data | Personal data collected and processed | Legal basis for the processing of your personal data | For how long we process your personal data |
Supplier and partner contract administration We process your personal data to administer contractual relationships with suppliers, partners, publishers, licensors and consultants
|
| The processing is necessary for Nextory's legitimate interest in administering the contract with the supplier organisation, where you are a contact person. Where the supplier is a sole trader, the processing is necessary for the performance of the contract.
| For the duration of the contract plus the statutory limitation period for claims
|
Accounting, invoicing and payments We process your personal data to process supplier invoices, make payments and maintain accounting records in accordance with applicable laws |
| The processing is necessary for Nextory to comply with its legal obligations under applicable accounting and tax law.
| 7 years from the end of the financial year in which the accounting record was created |
Publisher and licensor relationship management We process your personal data to manage relationships with content publishers and licensors, including catalogue negotiation, consumption reporting, invoicing and access to our Publisher Portal |
| The processing is necessary for Nextory’s legitimate interest in maintaining publisher and licensor relationships and meeting reporting obligations to them. | For the duration of the contract plus the statutory limitation period for claims
|
B2B marketing and communication We process your personal data to send commercial and informational communications to business contacts at suppliers, partners and prospective partners |
| The processing is necessary for Nextory’s legitimate interest in marketing to business contacts. | For as long as there is a professional relationship with you and the company or organization that you represent. |
Event administration We process your personal data to organise and administer events, including invitations, registration, attendance and practical arrangements |
| The processing is necessary for Nextory’s legitimate interest in organising events. For any dietary or accessibility information you provide voluntarily, the processing is based on your consent. | For as long as there is a professional relationship with you and the company or organization that you represent.
|
Establishing, exercising and defending legal claims We process your personal data where needed to establish, exercise or defend legal claims arising from supplier, partner and licensor relationships | Name and business contact details | The processing is necessary for Nextory’s legitimate interest in establishing, exercising and defending legal claims. | As long as necessary for the purpose of establishing, exercising or defending the legal claim |
As described above, we rely on our legitimate interest as the legal basis for certain purposes for which we process your personal data. For such processing, we rely on a legitimate interest assessment, through which we have determined that our legitimate interest to process your personal data for the relevant purpose overrides your interest and fundamental right to not have your personal data processed. Please contact us if you want to know more about how these assessments have been made. Our contact details can be found in Section 6 below.
Recipients of personal data
We have taken appropriate technical and organisational security measures to protect the personal data we process from unauthorised access. Only those who need to process personal data for the purposes for which they are processed have access to the personal data. In order to fulfil the purposes mentioned in Section 1 above, we sometimes may need to transfer your personal data to third parties. We always observe great caution when transferring your personal data and your personal data are only transferred in accordance with applicable law and this privacy notice. Your personal data may be transferred to the following categories of recipients:
- Group companies: We may share your personal data with other group companies for group-wide administration.
- Service providers and business partners: We may share your personal data with service providers and business partners who perform services on our behalf, such as IT services, CRM systems, accounting systems or administrative services. These companies have access to your personal data to the extent that they need it to perform their tasks, but they may not use or share the data for other purposes.
- Authorities and recipients in legal disputes: We may be required by law to share personal data with certain authorities. Sharing of personal data may also take place if we have a legitimate interest in establishing, asserting, or defending legal claims, such as with external counsel, courts or arbitral bodies.
Transfer of personal data to third countries
If a group company, service provider or business partner is located in a country outside of the EU/EEA, your personal data may be transferred to a country which may not provide appropriate or suitable safeguards. Where we transfer your data to countries outside the EU/EEA, we will do so on the basis of: (i) an adequacy decision by the European Commission; (ii) EU standard contract clauses; or (iii) another valid transfer mechanism under the GDPR. If you would like to receive further information about transfers to countries outside the EU/EEA, or if you would like to receive a copy of the safeguard we have used, you can contact us using the contact details set out in Section 6 below.
Your rights
You have the following rights in relation to our processing of your personal data.
- Right of access and information: You can request a copy of all information about you, information about the purpose of the processing, where we have obtained the information from, any recipients of the information, retention period and information about your rights as a data subject.
- Right to rectification: If you believe the data we have registered is inaccurate or incomplete, you can request that it be corrected or supplemented.
- Right to be forgotten: In certain cases, you can request that information about you be deleted. This right applies in particular circumstances, especially if your personal data is no longer necessary for the purposes for which it was collected. This right is not absolute, and we may retain your personal data for legal or legitimate reasons e.g. if it is necessary for establishing, exercising or defending legal claims.
- Right to restriction: You can request that the processing of your personal data should be restricted, for example if you do not think that the information we have about you is correct or if you believe that the processing is unlawful. Such request can also be made during the time we investigate whether our legitimate interests override your interest of privacy when you object to the processing (see more about this under right to object above).
- Right to object: You can object to the processing of your data, if our processing of your personal data is based on our legitimate interest. If you object, we do not have the right to process the data anymore, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or if it is needed for the establishment, exercise or defense of legal claims. If we consider that we have such legitimate grounds, or if the data are needed for the establishment, exercise or defense of legal claims, we will notify you of this, and the reasons for such assessment. You can also object to your personal data being processed for marketing purposes. If you do so, we will cease the processing of your data for these purposes.
- Right to data portability: You may request to receive (and to transmit to another data controller) your personal data collected on the basis of consent or for the fulfilment of an agreement in a machine-readable and commonly used file format.
- Right to withdraw consent: If our processing of your personal data is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of the processing that has already taken place.
If you wish to exercise any of these rights, you can do this by contacting Nextory using the contact details set out in section 6 below. In order to comply with your request, we may ask you to verify your identity. We may charge you a reasonable administrative fee when a request is manifestly unfounded or excessive, particularly if it is repetitive.
Changes to and updates of this Privacy Notice
We may make changes and updates to this Privacy Notice e.g., if there are changes in law, or to reflect other changes in our policies and procedures with respect to our processing of your personal data. We will inform you of any such changes in accordance with applicable data protection laws.
Contact information and complaints
If you have any questions or concerns regarding the processing of your personal data, you can contact us via the contact information below. You can also lodge a complaint to the Swedish Authority for Privacy Protection (or with another local data protection authority if you believe that Nextory’s processing of your personal data is not in accordance with EU data protection laws.
NEXTORY AB
Address: Norrtullsgatan 6, 113 29 Stockholm, Sweden
E-mail: privacy@nextory.com
Data Protection Officer: Gustaf Sköld