Privacy Notice
Elanders AB (publ) · Version of 8 October 2026
1. Who we are and what this notice covers
This privacy notice explains how Elanders AB (publ) processes personal data about visitors to this website, people who contact us, subscribers to our newsletters and investor communications, and our general business contacts.
Controller
Elanders AB (publ), Swedish company registration number 556008-1621, Flöjelbergsgatan 1 C, SE-431 37 Mölndal, Sweden. Telephone +46 31 750 00 00. General enquiries: info@elanders.com. For all data protection matters, including requests to exercise your rights, please use dataprotection@elanders.com as set out below.
Data protection contact
We have appointed a Group Data Protection Officer. You can contact the Data Protection Officer at dataprotection@elanders.com, or by post at the address above marked for the attention of the Data Protection Officer.
What this notice does not cover
Elanders is a group of companies. If you are an employee, a job applicant, or a contact at one of our customers or suppliers, the Elanders company you deal with is the controller for that relationship and provides its own privacy information. This notice does not replace it. This notice also does not cover websites operated by other Elanders companies, which publish their own notices.
Wherever we say “we” or “Elanders” in this notice, we mean Elanders AB (publ) acting as controller for the processing described here.
2. What we process, why, and on what legal basis
We process personal data only where we have a legal basis under Article 6 GDPR. The table below sets out each purpose, the data involved, the basis we rely on, and how long we keep the data.
| Purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Responding to enquiries you send us by email, telephone or a contact form | Your name, email address, telephone number, and any other information you choose to include | Article 6(1)(b) GDPR where your enquiry relates to a contract with us; otherwise Article 6(1)(f) GDPR – our legitimate interest in answering people who approach us | Until your enquiry is resolved, and thereafter for as long as we need to evidence how we handled it or to meet a statutory retention obligation |
| Sending newsletters, press releases and financial reports you have subscribed to | Your name, email address and subscription preferences | Article 6(1)(a) GDPR – your consent | Until you unsubscribe or withdraw your consent; we then keep a record of the withdrawal for as long as we need it to demonstrate that we acted on it |
| Maintaining relationships with our business contacts at customers, suppliers and partners | Name, business contact details, employer, role and our correspondence with you, obtained either from you or from the sources described below this table | Article 6(1)(f) GDPR – our legitimate interest in maintaining business relationships | For as long as the business relationship continues, and thereafter until the contact is no longer relevant to our business or you object |
| Operating and securing this website, including defending against automated abuse and spam | IP address, browser and device information, pages visited, time of access and interaction data, including the data evaluated by reCAPTCHA | Article 6(1)(f) GDPR – our legitimate interest in keeping this website available and secure | For as long as we need the data to keep the site secure and to investigate incidents |
| Analysing how this website is used so that we can improve it | Usage and device data collected through analytics cookies | Article 6(1)(a) GDPR – your consent, given through the cookie banner | For the retention period configured in the analytics service, or until you withdraw your consent, whichever is earlier |
| Displaying maps that show where our locations are | IP address, browser and device information, and your interaction with the map | Article 6(1)(a) GDPR – your consent, given through the cookie banner | For the period configured by the map provider, or until you withdraw your consent, whichever is earlier |
| Handling requests to exercise data protection rights, and complaints | Your identity and contact details, the content of your request and our correspondence | Article 6(1)(c) GDPR – compliance with our obligations under Articles 12 to 22 GDPR | For as long as we need the record to demonstrate that we complied with those obligations |
| Meeting statutory obligations, for example under accounting, tax, securities and company law | The data required by the obligation concerned | Article 6(1)(c) GDPR | The retention period prescribed by the relevant law |
| Establishing, exercising or defending legal claims | The data relevant to the claim concerned | Article 6(1)(f) GDPR – our legitimate interest in defending our legal position | Until the claim is resolved and any applicable limitation period has expired |
Where we obtain your personal data from sources other than you
We obtain some business contact data from sources other than the people it relates to. Those sources are: contacts made at trade fairs, conferences and other events; professional networking services such as LinkedIn; commercial contact databases we subscribe to; and publicly accessible sources such as company websites, corporate registers and public professional directories.
Where we obtain personal data in this way, it is limited to business contact data – your name, your employer, your role and your business contact details. We process it on the basis of Article 6(1)(f) GDPR, for the purpose of maintaining business relationships, as set out in the table above.
If we obtain your personal data from one of these sources, we will inform you within a reasonable period and at the latest within one month, or, if we use the data to communicate with you, at the latest at the time of our first communication with you. You have the right to object to this processing at any time, on grounds relating to your particular situation – see section 7.
Where we rely on legitimate interests
Where the table names Article 6(1)(f) GDPR, we have weighed our interest against your interests, rights and freedoms. You can ask us for information about that assessment at any time using the contact details in section 1, and you can object to the processing – see section 7.
Whether you have to provide personal data
You are not required by law or by contract to give us personal data through this website. If you contact us or subscribe to a service without providing the data marked as necessary in the relevant form, we may not be able to answer you or to deliver the subscription.
3. Cookies and similar technologies
Cookies are small files stored on your device. Some are strictly necessary for this website to work. All others are set only if you consent.
We ask for your consent through the banner shown when you first visit this website. Storing information on your device, or gaining access to information already stored there, requires your consent under Chapter 9, Section 28 of the Swedish Electronic Communications Act (lag (2022:482) om elektronisk kommunikation), except where it is strictly necessary in order to provide the service you have requested. The subsequent processing of the data collected is based on Article 6(1)(a) GDPR.
You can withdraw or change your consent at any time through the cookie settings link in the footer of every page. The cookie settings panel lists each cookie we use, its purpose, its provider and how long it is stored. Withdrawal takes effect for the future and does not affect the lawfulness of processing carried out before it.
Strictly necessary cookies
These cookies keep this website functioning, record the cookie choices you have made, and protect our forms against automated abuse. They are set without consent, on the basis of Article 6(1)(f) GDPR and the exception in the Electronic Communications Act referred to above.
Analytics
With your consent we use Google Analytics, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how this website is used. It collects usage and device data, including your IP address, the pages you visit and how you interact with them, and uses it to produce aggregated statistics. You can withdraw your consent at any time through the cookie settings, or install Google’s opt-out browser add-on.
reCAPTCHA
We use Google reCAPTCHA, also provided by Google Ireland Limited, to distinguish human users from automated programs. reCAPTCHA evaluates information such as your IP address, the time you spend on the page and your mouse movements, and transmits it to Google.
We use reCAPTCHA without asking for your consent, because it is necessary in order to provide this website and its forms securely and therefore falls within the exception in Chapter 9, Section 28 of the Swedish Electronic Communications Act. The personal data it collects is processed on the basis of Article 6(1)(f) GDPR – our legitimate interest in protecting this website and its forms against automated abuse and spam. We do not use it for any other purpose. You have the right to object to this processing on grounds relating to your particular situation – see section 7.
Maps
With your consent we embed maps provided by Google Ireland Limited, so that you can see where our locations are. When a map is loaded, your IP address, information about your browser and device, and your interaction with the map are transmitted to Google. If you do not consent, the map is not loaded and the location information remains available to you as text.
Transfers connected with these services
The Google services described above are provided by Google Ireland Limited, which may transfer data to Google LLC in the United States. Google LLC is certified under the EU–US Data Privacy Framework, and transfers covered by that certification are made on the basis of the European Commission’s adequacy decision of 10 July 2023 under Article 45 GDPR. Any transfer not covered by that certification is made under the European Commission’s standard contractual clauses under Article 46(2)(c) GDPR, together with any supplementary measures the transfer requires.
Further information is available in Google’s privacy policy and terms of service.
4. Who we share personal data with
We do not sell personal data, and we do not share it for anyone else’s own purposes unless this notice says so or you have agreed to it.
We disclose personal data to:
- Other Elanders group companies, where they need it for the purposes described in section 2. Transfers within the group are governed by our Binding Corporate Rules – see section 5.
- Service providers acting on our instructions, including providers of website hosting and maintenance, email and collaboration tools, analytics, distribution of press releases and investor communications, and IT support. Each is bound by a written processing agreement meeting the requirements of Article 28(3) GDPR, which obliges them to process personal data only on our documented instructions and to apply appropriate technical and organisational security measures.
- Professional advisers, such as lawyers, auditors and accountants, where they need the data in order to advise us.
- Public authorities and courts, where we are legally required to disclose the data, or where disclosure is necessary to establish, exercise or defend legal claims.
Where a service provider processes personal data outside the European Economic Area, section 5 applies.
5. Transfers outside the EEA and our Binding Corporate Rules
Elanders operates in around 20 countries. Some of the personal data described in this notice is therefore transferred to Elanders companies or to service providers outside the European Economic Area.
Transfers within the Elanders group
Elanders AB has adopted Binding Corporate Rules for controllers, approved by the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) under Article 47 GDPR following an opinion of the European Data Protection Board. The Binding Corporate Rules are an appropriate safeguard within the meaning of Article 46(2)(b) GDPR. They bind every Elanders company listed in them and apply to all personal data transferred within the group within their scope.
The Binding Corporate Rules give you rights that you can enforce directly against Elanders as a third-party beneficiary, including against Elanders AB, which accepts liability for breaches of the rules by Elanders companies outside the EEA. You can enforce those rights before a supervisory authority or before a court, and you may claim compensation for material or non-material damage. You may also be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) GDPR.
You can read the full text of our Binding Corporate Rules, including the list of the Elanders companies bound by them and the definitions used in them, here: Elanders Binding Corporate Rules. We publish any update to the rules, and to the list of companies bound by them, without undue delay.
Transfers to service providers outside the group
Where we use a service provider outside the EEA, we transfer personal data only on the basis of an adequacy decision of the European Commission under Article 45 GDPR, or under appropriate safeguards under Article 46 GDPR, in particular the European Commission’s standard contractual clauses together with any supplementary measures the transfer requires. You can ask us for a copy of the safeguards in place using the contact details in section 1.
6. How long we keep personal data
We keep personal data only for as long as we need it for the purpose for which we collected it, or for as long as the law requires. The retention period, or the criteria we use to determine it, is set out for each purpose in the table in section 2.
Where no fixed period is stated there, we apply the following criteria: how long the relationship or enquiry remains live; whether we still need the data to meet a legal obligation; and whether a limitation period for potential legal claims is still running. When none of these applies, we erase the data or anonymise it so that it can no longer be linked to you.
7. Your rights
Under the GDPR you have the following rights in relation to personal data for which we are the controller.
- Access (Article 15 GDPR) – to be told whether we process personal data about you and, if we do, to receive a copy of that data together with information about the purposes, the recipients, the retention period and the other matters listed in Article 15(1) GDPR.
- Rectification (Article 16 GDPR) – to have inaccurate personal data corrected and incomplete personal data completed.
- Erasure (Article 17 GDPR) – to have your personal data erased where one of the grounds in Article 17(1) GDPR applies.
- Restriction of processing (Article 18 GDPR) – to have our processing restricted in the situations set out in Article 18(1) GDPR, for example while we verify the accuracy of data whose accuracy you have contested.
- Notification to recipients (Article 19 GDPR) – we will communicate any rectification, erasure or restriction to each recipient to whom we have disclosed your personal data, unless this proves impossible or involves disproportionate effort. We will tell you who those recipients are if you ask us.
- Data portability (Article 20 GDPR) – where we process your personal data by automated means on the basis of your consent or of a contract, to receive that data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where this is technically feasible.
- Not to be subject to automated decision-making (Article 22 GDPR) – see section 10.
- Withdrawal of consent (Article 7(3) GDPR) – where we rely on your consent, to withdraw it at any time. Withdrawing consent is as easy as giving it and takes effect for the future; it does not affect the lawfulness of processing carried out before the withdrawal.
Your right to object
Where we process personal data about you on the basis of our legitimate interests under Article 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation. If you object, we will no longer process that data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.
Where we process personal data for direct marketing purposes, you have the right to object at any time without giving any reason. If you object, we will stop processing your personal data for that purpose immediately.
8. How to exercise your rights
Write to us at dataprotection@elanders.com, or by post to Elanders AB, Flöjelbergsgatan 1 C, SE-431 37 Mölndal, Sweden, marked for the attention of the Data Protection Officer.
There is no required form. You may contact us by email, by post or by telephone, in any of the languages in which this notice is published, and you do not need to use any particular wording. You may use our request form if you find it convenient, but you are not obliged to do so. It helps us if you tell us which categories of personal data your request concerns, although you do not have to.
How we respond. We will reply without undue delay and in any event within one month of receiving your request. If your request is complex, or if you have made a number of requests, we may extend that period by up to two further months; we will tell you within the first month if we do so, and explain why. If you contacted us electronically, we will reply electronically in a commonly used format unless you ask us to use a different channel.
Confirming your identity. We will ask you for further information in order to confirm your identity only where we have reasonable doubts about who you are, and we will ask only for what is necessary for that purpose. We do not require a handwritten signature, an identity document or postal correspondence as a general condition for handling a request.
Cost. Exercising your rights is free of charge. Only where a request is manifestly unfounded or excessive, in particular because it is repetitive, may we charge a reasonable fee or refuse to act on it. It is for us to demonstrate that a request is manifestly unfounded or excessive. If we take either step, we will explain our reasons and tell you how to challenge the decision.
If we do not act on your request. We will tell you why within one month of receiving it, and inform you that you may lodge a complaint with a supervisory authority and seek a judicial remedy.
9. Your right to complain
If you are not satisfied with the way we handle your personal data or your request, you can complain to us at dataprotection@elanders.com. You do not have to complain to us before approaching a supervisory authority or a court.
Supervisory authority. You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA member state where you live, where you work, or where you believe the infringement took place. Our lead supervisory authority is the Swedish Authority for Privacy Protection:
Integritetsskyddsmyndigheten (IMY), Box 8114, SE-104 20 Stockholm, Sweden. Telephone +46 8 657 61 00. Email imy@imy.se. Website www.imy.se.
Courts. You also have the right to an effective judicial remedy. You may bring proceedings before the courts of the member state where we have an establishment, or before the courts of the member state where you live. You may claim compensation for material or non-material damage you have suffered as a result of an infringement.
Representation. You may mandate a not-for-profit body, organisation or association active in the field of data protection to lodge a complaint or to exercise these rights on your behalf, under the conditions set out in Article 80(1) GDPR.
10. Automated decision-making, security, and changes to this notice
Automated decision-making. In relation to the processing described in this notice, we do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or which similarly significantly affect you.
Security. We apply technical and organisational measures appropriate to the risk, including access controls that limit access to staff who need the data for their work, additional controls for special categories of personal data, and measures to protect against unauthorised access, accidental loss and unauthorised alteration. Our staff are trained in data protection and are bound by confidentiality.
Changes to this notice. We update this notice whenever our processing or the applicable legal requirements change. The current version is always published on this page.
This version is dated 8 October 2026.