Active since: 2024-01-19
This document (the “Privacy Notice”) describes how we at Envac process your personal data when you use our ReFlow application (the “App”) and other ReFlow services (“Services”) - what personal data we collect about our users, what we do with it, how we protect it and your rights regarding your personal data.
Your privacy is and will always be enormously important to us. Our Privacy Notice is designed to provide transparency into our data practices in a format that is easy to read and navigate. Please read the sections below to understand how we collect, use, share, and safeguard your information in order to offer you the most seamless waste experience imaginable.
Envac AB, with registration number 556611-5555 and address Fleminggatan 7, 112 26 Stockholm, Sweden (“Envac”), is the data controller and accountable for the processing of your personal data. When we below write “we”, “our”, or “us”, we refer to Envac.
We may collect four main types of personal data from you that is related to you or your use of our Services:
You are not legally required to provide your personal data to us. However, for us to be able to provide the Services to you, you need to provide the personal data necessary for us to set up your account and to provide you with information about your usage of the waste inlets within the Envac System.
We may collect personal data about you from other sources such as public databases, marketing partners, property owners, real estate management companies, affiliates and business partners, and social media platforms.
Envac's processing of your personal data will depend on how you interact with Envac or use the App and the Services. In the sections below, you will find more detailed information.
When you request access to the App and the Services or you contact us with questions or for product information (in person, online, telephone, and email) we may collect personal data from you.
| Purpose of the processing | Personal data we process | Legal basis for the processing | How long we store your personal data |
|---|---|---|---|
| To process your request for user access to the App and the Services. | Your name, address, region, email, phone number, contact preference, communications and interactions with you | To take steps at your request prior to entering into a contract (GDPR article 6.1 b) | Until contract entered or request withdrawn |
| Managing requests for information, calls, emails, or in person communications, ReFlow events, and App demos | Your name, address, region, email, phone number, communications and interactions with you | Our legitimate interest to provide efficient communication and customer service (GDPR article 6.1 f) | During our business relation |
If you are a ReFlow user, we will collect personal data from and/or about you and/or your usage of the Envac System and the Services. Such personal data can be collected either remotely or from you directly (for example, during an appointment to register your access to inlets).
ReFlow users who install ReFlow creates a ReFlow account, which is hosted on our servers. You can access your ReFlow account to update your information in that account at any time. The information contained in your account includes:
In the table below, you will find more detailed information about how we process personal data about all ReFlow users.
| Purpose of the processing | Personal data we process | Legal basis for the processing | How long we store your personal data |
|---|---|---|---|
| To be able to create and maintain your user account, to provide basic service functionality like showing nearby waste collection stations, and to give accurate statistics and tips on how to decrease your environmental footprint | Activation code, User info (email, your first and last name), household info (address, household identifier, move-in date, household size) | To perform according to our contract with you regarding the Services (GDPR article 6.1 b) | As long as you have a user account within the Services |
| To maintain the integrity, security and reliability of the Services, such as preventing spam and DDOS attacks, debug problems and issues with certain devices, operating systems or versions, and provide a better upgrade experience | Device info (IP-address, App version, operating system, device model, installation unique identifier (UUID)), system logs and usage data | Our legitimate interest to ensure the security and optimal functioning of the Services (GDPR article 6.1 f) | As long as you have a user account within the Services |
| To better be able to select the proper language and unit (time, date and currency) format for improved user experience | Device language and locale | Our legitimate interest to provide a good user experience (GDPR article 6.1 f) | As long as you have a user account within the Services |
| Business analytics, review, reporting and forecasting | Usage data & feedback | Our legitimate interest to improve and develop our business, products and services (GDPR article 6.1 f) | Two years after you have unregistered as a user of the Services |
| Improve and modify the Envac System, and to conduct research, develop and promote new products and services | Usage data & feedback | Our legitimate interest to improve and develop our business, products and services (GDPR article 6.1 f) | Two years after you have unregistered as a user of the Services |
| Marketing of our products and services | Usage data & feedback | Our legitimate interest of being able to market our products and services to you (GDPR article 6.1 f) | Two years after you have unregistered as a user of the Services |
| Fraud monitoring and prevention | IP-adress | Our legitimate interest to prevent that our App, the Envac System, and the Services are being used for fraudulent purposes (GDPR article 6.1 f) | As long as you have a user account within the Services |
| To be able to send push notifications to you | Push notification token | Your consent (GDPR article 6.1 a) | As long as you have a user account within the Services or, if earlier, until your consent is revoked |
| To be able to safely provide access to the Services | Access token, refresh token | Our legitimate interest to provide a good user experience (GDPR article 6.1 f) | As long as you have a user account within the Services |
| To communicate with you and process your customer service requests | Your user information and feedback sent | Our legitimate interest to provide customer service and a good user experience (GDPR article 6.1 f) | As long as you have a user account within the Services |
| Anonymisation of data for research and development | Any personal data that we process about you, depending on the research project | Our legitimate interest to improve and develop our business, products and services (GDPR article 6.1 f) | Until the data has been anonymised |
| To establish, exercise or defend legal claims | Any personal data that we process about you, depending on the claim | Our legitimate interest in being able to establish, exercise or defend our legal rights (GDPR article 6.1 f) | As long as the specific personal data is processed by us according to this Privacy Notice, or until a potential claim/dispute has been settled |
When you use our Services on an individual or household level, we process certain additional personal data about you to provide such Services. Your possibilities to use the Services will depend on how the Envac System has been installed in the specific area or property where you live. In the table below, you will find more detailed information.
| Purpose of the processing | Personal data we process | Legal basis for the processing | How long we store your personal data |
|---|---|---|---|
| To be able to give accurate statistics about your use of the Envac System, and give you tips on how to decrease your environmental footprint | Waste throw data (used inlet, inlet - household index, waste fraction, waste weight, timestamp) | To perform according to our contract with you regarding the Services (GDPR article 6.1 b) | As long as you have a user account within the Services |
| To communicate with you, process your request, and provide the Services based on the actual systems present in your area | Information about you and (your proximity to) the waste collection systems in your area | To perform according to our contract with you regarding the Services (GDPR article 6.1 b) | As long as you have a user account within the Services |
| To be able to give accurate statistics about your use of the services that enable digital sharing and reusing of goods (“Reuse Service”) and tips on how to decrease your environmental footprint | Reuse data (posts within the Reuse Service with items you give away, lend out, items you lend or receive) | To perform according to our contract with you regarding the Services (GDPR article 6.1 b) | As long as you have a user account within the Services |
| To be able to provide support when reusing items and to follow up on potential report of messages and posts within the Reuse Service | Messages and reports associated with reusing items | Our legitimate interest to provide customer support and a good user experience (GDPR article 6.1 f) | Until your request has been processed |
We will share the personal data mentioned in this policy with our service providers, business partners and affiliated companies within the Envac Group. Service providers that we hire to process personal data on our behalf must abide by our privacy and data protection requirements and are not allowed to use personal data they receive from us for any other purpose.
Furthermore, we will share your personal data with public authorities when required by law or our legitimate interests, or to other third parties that you specifically authorize.
In the table below, we summarize how we share your personal data.
| Categories of recipients | Description | Personal data shared | Reason for sharing |
|---|---|---|---|
| Affiliates and subsidiaries | Companies that are owned or controlled by Envac, or where we have a substantial ownership interest | All data as stated in this policy | To assist, operate, enhance, and fulfill the Services on our behalf based on our outsourcing of certain operations |
| Service providers and business partners | Companies we have hired to provide services like website hosting, data analysis and storage, payment processing, order fulfillment and product installation, wireless connectivity to Envac products, information technology and related infrastructure, customer service, product design, product diagnostics, maintenance or related services, email delivery, auditing, marketing, voice command processing, and other similar services | All data as stated in this policy | To assist, operate, and fulfill sthe Services on our behalf based on our legitimate interests to outsource certain operations |
| The owner of the Envac System, including but not limited to the property manager, the household association or installation service organisation of the Envac System. | Companies that have hired Envac to provide services like customer support, product financing, repair estimate providers, infrastructure, and other professional service providers | All data as stated in this policy | To assist, operate, and fulfill services in relation to owners of the Envac System |
| Universities and other research institutions | Academic institutions | Envac only shares anonymised data for research projects. The researchers in question will not receive personal data from Envac | To evaluate findings from various project activities to help design better education and feedback in the future |
| Law enforcement and other authorities | Requests from law enforcement and other authorities | Any personal data that we process about you, depending on the request | When required by law or our legitimate interests to comply with the request if deemed necessary or important considering our business interests or other issues of public importance |
We may also share information about you, where we have a legal ground to do so, if we determine that disclosure is reasonably necessary to enforce our Terms of Use or protect our operations or customers. Additionally, in the event of a reorganization, merger, change of control, sale, or insolvency proceedings, we may transfer any personal data we collect to the relevant third party. You will however be notified about such an event in advance to be able to opt-out.
Envac is a global company, and we operate internationally. By submitting your personal data to us, your data may be transferred to countries other than your place of residence or in which the personal data was originally collected. For example, where we have facilities or where we engage with service providers. Envac complies with laws on the transfer of personal data between countries to help ensure your data is protected as described in this Privacy Notice, wherever it may be.
For transfers from EU/EEA to countries outside the EU/EEA where the EU Commission has determined that the country offers an adequate level of data protection, the EU Commission’s adequacy decision apply (article 45 of the GDPR). For transfers from the EU/EEA, the United Kingdom (UK) or Switzerland to countries outside such geographic areas, we have entered into EU Model Clauses with all relevant third parties (article 46 of the GDPR), which can be found on the following links:
Right of access: We want you to be in control of how your personal data is used by us. We enable you to obtain access and control your personal data that we collect, use, and share. Subject to local law, you have the right to request access to the personal data we process about you and to request information about, among other things, for which purposes we have processed your personal data and which third parties your personal data has been shared with. We will also provide you with a copy of your personal data that we are processing.
Right to rectification: You have the right to, without undue delay, have inaccurate personal data about you corrected. You can also complement the personal data that is processed to ensure that they are accurate. When we have rectified your personal data, or after it has been complemented, we will inform the recipients of your personal data, provided that this is not impossible or too burdensome. Upon your request, we will tell you whom we have shared your personal data. If you request rectification, you also have a right to request restriction during the time that we investigate your matter.
Right to deletion: In certain situations, you have a right to have your personal data deleted, for example if they are no longer necessary for the purpose, if they have been processed unlawfully, or if the processing is based on your consent that you have withdrawn. However, we may be required to keep your personal data due to legal or contractual requirements. If we delete your personal data upon your request, we will also inform third parties that we have disclosed your personal data to, provided that this is not impossible or too burdensome. Upon your request, we will tell you whom we have shared your personal data.
Right to object: When you request information, purchase a product, or sign up for promotional communications, Envac may contact you by email, call, text, or via the App about promotions, our products and services, and other information that may be of interest to you. If you no longer want to receive marketing emails or messages, you may opt out at any time by following the unsubscribe instructions in the communication received from us, by changing your communication preferences, or by telling us using any method from section 7 (Privacy questions) below. If you receive a call or text from us and do not want to receive similar calls in the future, please note that we may still be required to send you administrative or other important messages, such as billing notices or policy changes, even if you opt out of receiving other communications.
In addition to the above, you may at any time object to our processing of your personal data when our legal basis for the processing is our legitimate interest. We are then not entitled to continue processing your personal data unless we can show compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Right to restriction: In certain situations you have a right to request that we restrict our processing of your personal data. For example during the time when we verify your request for rectification or if you consider our processing to be unlawful but want us to restrict the processing instead of deleting the personal data. If we restrict the processing of your personal data upon your request, we will also inform third parties that we have disclosed your personal data to, provided that this is not impossible or too burdensome. Upon your request, we will tell you whom we have shared your personal data.
Right to data portability: You have a right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transfer this personal data to another data controller without hindrance from Envac. This only applies if the processing is automated and is based on our performance of the contract with your or if it is based on your consent.
Right to withdraw consent: If you have provided your consent for us to process your personal data, you may withdraw such consent at any time. The withdrawal of your consent will not affect the lawfulness of our processing of your personal data before the withdrawal.
Right to complain: If you are dissatisfied with how we have processed your personal data you are welcome to contact us, see contact information in section 7 (Privacy questions) below. You always have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten), see contact information in section 7 (Privacy questions) below, or your local data protection authority.
This Privacy Notice sets out the essential details relating to our processing of your personal data. From time to time, we may develop new capabilities, features, or offer additional services which may require we make material changes to this Privacy Notice. When we do, we'll let you know by revising the date this Privacy Notice was last updated on our website. Other times, we may provide you with additional notice (such as an email) with more information about the revisions. Unless stated otherwise when we introduce these new or additional services, they will be subject to this Privacy Notice and become effective when we post it on our website.
For privacy questions or comments, to exercise your rights, to opt out from certain services, or to submit a data privacy request, please contact us by emailing privacy@envac.se, or by writing to us at Envac AB, Fleminggatan 7, 112 26 Stockholm, Sweden.
When contacting Envac and where your issue requires it, we may request information from you, such as to verify identity, or indicate that a response will require additional time. If you ask us, we will endeavor to provide you with information about relevant complaint avenues which may be applicable to your circumstances.
The contact information to the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten) is: Box 8114, 104 20 Stockholm, +46-8-657 61 00, imy@imy.se.