Privacy policy

Which personal data is processed?

Personal data from persons involved in limited liability companies or other organisations through either key position, board, ownership or beneficial ownership. The sources of personal data are publicly available documents or data provided by responsible authorities. Valu8 also processes personal data of clients as stated in Integrity Policy Customers. No other information about persons is processed.

Personal data stored by Valu8 is name, birth date or birth year, including personal registration number, board position, number of shares in given organisations, ownership or beneficial ownership in given organisations and address.

How is the collection of personal data performed?

The personal data is collected and processed by authorities and companies and then transferred to Valu8 via data feeds or API

The personal data is entered digitally into Valu8's databases via feeds or API solutions from group companies, subcontractors, government institutions and public authorities (‘the suppliers’). The suppliers are independently responsible for their processing of data.

Legal grounds for processing personal data

Valu8 processes personal data based on legitimate interests according to article 6.1.f GDPR. Valu8 seeks to provide a comprehensive and reliable database service that enables corporate transparency and facilitates informed business decisions. Valu8 has conducted a balancing test and concluded that the processing is of legitimate interest. Valu8 has a legitimate interest in collecting, processing and providing access to publicly available corporate information to enable:

• Corporate transparency and accountability

• Informed business decision making

• Compliance with legal obligations, including KYC and AML

• Due diligence processes

• Risk assessment and management

Our clients have a legitimate need to access verified corporate information to fulfill their own legal obligations and make informed commercial decisions.

The data subjects have a right to privacy and protection of personal data. They have a right to control their personal information and an interest in limiting the dissemination of their personal data.

The personal data processed is already publicly available through authorities. The data is limited to information relevant for corporate transparency purposes. Access to the database is restricted to authenticated subscribers with legitimate business purposes. Data subjects can reasonably expect their corporate roles and ownership to be accessible given the public nature of this information and their position in a company.

Based on the balancing test, it is concluded that the processing of personal data is necessary to achieve

the legitimate interests identified above. The legitimate interests in processing this data outweigh the interests of the data subjects.

Sharing with third parties

Personal data collected from clients is stored on an external server provided by a third-party hosting service. The company leases server capacity from this external provider. All personal information is transmitted securely to the server and stored in accordance with applicable data protection laws. The external hosting provider acts as a data processor on behalf of Valu8 and has entered into a data processing agreement, DPA, with Valu8, ensuring appropriate technical and organisational security measures are implemented to protect the confidentiality, integrity, and availability of personal data. The server infrastructure is located within the EU/EEA, specifically in Sweden, Germany and The Netherlands. Your data is never transferred outside the EU/EEA area. The hosting provider may use approved sub-processors to deliver the service. We ensure that all sub-processors are bound by the same data protection obligations. You may request information about our data processing agreement, including details about our hosting provider, security measures and where data is stored.

Cookie Declaration

Why are these personal data stored?

The clients and users of Valu8's services have legitimate reasons to access enriched and verified corporate information based on publicly available sources. Valu8 collects and processes this data to ensure that our clients can fulfil their legal obligations to identify and verify the owners, board members, and key representatives of companies to enable customers to perform corporate analysis, due diligence, and support decision-making. Access to personal registration number is, in cases where it is legally necessary, restricted to clients with legitimate “Know Your Customer”, KYC, and Anti-money laundering, AML, purposes.

Where the data is processed

The personal data is stored and processed within the EU/EES area.

Who can access the personal data?

Valu8's clients and users access personal data through their individual and password protected logins or through comparable digital authentication. All access to personal data processed by Valu8 also requires an active subscription provided and managed by Valu8. The personal data processed by Valu8 is thus not accessible to the public in any way or form. Access to personal registration number is, in cases where it is legally necessary, restricted to clients with legitimate “Know Your Customer”, KYC, and Anti-money laundering, AML, purposes.

For how long is the personal data saved?

Due to the legal and commercial interest in the information, combined with its public nature, and the fact that the information, through public authorities, is widely available, the information is not obsolete and is constantly available. To protect personal integrity, personal data of individuals who no longer have an active role in a company are stored for five years to allow compliance with AML and KYC requirements. Valu8 performs annual checks of the database to delete obsolete data.

Security

The personal data is only accessible for users with an active subscription to Valu8 services and a valid password generated by Valu8. The Valu8 platform is only accessible via a firewall to prevent unauthorized data access. The personal data available is minimized by not allowing access to unique personal identifiers such as personal registration number. Access to source data is restricted to key employees. The personal data is encrypted to ensure that any unauthorized access to data will not result in personal data being compromised.

Who is responsible for processing personal data in accordance with current legislation?

Personal data collection, compliance with current legislation and the protection of personal integrity fall under the responsibility of the Data Protection Officer. See contact details below.

Your rights

As an individual whose personal data is processed by Valu8, you have the following rights under the General Data Protection Regulation (GDPR):

You have the right to obtain confirmation as to whether personal data concerning you is being processed, and if so, to receive access to that personal data and information about how it is being processed. You may request a copy of your personal data free of charge.

You have the right to have inaccurate personal data concerning you corrected without undue delay. You also have the right to have incomplete personal data completed, including by providing a supplementary statement.

In certain circumstances, you have the right to request the erasure of your personal data without undue delay. Please note that this right is not absolute, and Valu8 may have legitimate grounds to retain certain information, for example to comply with legal obligations or establish, exercise or defend legal claims.

You have the right to object at any time to the processing of your personal data where the processing is based on legitimate interests (Article 6(1)(f) GDPR), including profiling based on those provisions. If you object to the processing, Valu8 will cease processing your personal data unless we can demonstrate legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

To exercise any of these rights, please contact the Data Protection Officer.

Filing a complaint

If you believe that the processing of your personal data infringes the GDPR or other applicable law you have the right to lodge a complaint with Integritetsskyddsmyndigheten.

Persons are entitled to access to personal data processed by Valu8. To request this information, a written and signed request with relevant contact information is sent to:

Data Protection Officer

Karl von Baumgarten
dpo@valu8group.com
Valuation Europe AB