Last updated: March 28, 2025

Privacy noticeAt CBG Konsult & Information AB (company registration number 556172-1993) and its subsidiaries (hereinafter "CBG," "we," "us," or "our"), we value your privacy and are committed to protecting your personal information in accordance with applicable data protection laws. This privacy notice outlines how we collect, use, share, and protect your personal data, as well as describes your rights.

ScopeThis privacy notice applies to the personal data we obtain through our normal business operations in relation to sales and marketing, translating supplier engagements, recruitment activities, and website interactions.

Data controllerThe data controller responsible for the processing of your personal data is the CBG entity that initially collected your data and determined the purposes and means for using your data. For any questions or concerns, contact us at dataprotection@cbg.com.

Personal data we collectPersonal data refers to any information that, individually or in combination with other information, can be used to identify you as an individual. We may collect and process the following categories of personal data:

• Identification and contact data: Your name, postal address, email address, phone number, and other identifiers you provide.
• Recruitment data: Information you provide when applying for a role, including your CV and employment history.
• Event data: Data that you provide to us in connection with registering for and attending events.
• Technical data: Data from your visits to our website, including IP address and cookies. For more information, read our cookie policy.
• Other data: Any additional personal data you provide to us.

How and why we use your personal dataWe process your personal data only when legally permitted according to these lawful bases:

• Contract performance: Where your information is necessary for the performance of our contract with you.
• Legal obligation: Where we need to use your information to comply with our legal obligations.
• Consent: Where you have given your consent to the processing of your personal information for one or more specific purposes.
• Legitimate interests: Where we use your information to pursue our legitimate interests, ensuring that our reasons for processing it outweigh any potential impact on your fundamental data protection rights.

Please find below how we may use your personal data and why.

We will only process your personal data for the purposes for which we collected it unless required otherwise by law.

Automated decision-making and profilingWe do not use automated decision-making or profiling.

How we share your personal dataWithin CBG
We may share your personal data across various business functions that require access to fulfill our contractual and legal obligations, such as sales, accounting, operations, and legal. Additionally, we may use your data for our legitimate interests, including marketing.

Third-party service providers
We may share your data with third parties, such as processors, who perform services on our behalf, including IT services, payment processors, recruitment services, and marketing agencies. We ensure these parties adhere to our data protection standards.

Authorities as required by law
If required by law or regulatory obligations, such as in response to legal requests, we may share your data.

International data transfersYour personal data may be transferred outside the EU/EAA. In these cases, we ensure appropriate safeguards, such as:

• Transferring only to countries recognized by the European Commission as providing an adequate level of data protection, or
• Using Standard Contractual Clauses approved by the European Commission.

Data retentionWe retain your personal data only as long as necessary to fulfill the purposes we collected it for or to comply with legal obligations. Specific retention periods depend on the type of data and applicable laws. For detailed retention periods or if you have specific questions about how long we retain your personal data, you can contact us at dataprotection@cbg.com.

Data securityWe have implemented appropriate technical measures to protect your personal data against:

• Unauthorized access
• Improper use or disclosure
• Unlawful destruction or accidental loss

Your rightsYou have the right to exercise a number of rights regarding our processing of your personal data. These rights include:

• Withdraw consent: If we process personal data based on your consent, you can withdraw it at any time. Upon withdrawal, we will cease processing your data for the relevant purposes unless we have another legitimate basis to continue.
• Access: You have the right to request access to the personal data we hold about you. Upon your request, we will provide a copy of your data detailing the information we process, the purpose of the processing, and any recipients with whom we share your data. We aim to respond without undue delay and within one month, unless we need to request an extension from you.
• Rectification: You may request the correction or completion of any inaccurate or incomplete data we hold about you.
• Erasure: You may request that we delete your personal data in certain situations, such as when it is no longer necessary for the purpose it was collected or when you withdraw your consent.
• Restriction: You have the right to request the restriction of processing in specific circumstances, for example, while we verify the accuracy of your data following a correction request. We will inform you when the restriction ends.
• Data portability: For personal data processed by automated means and based on consent or a performance contract, you have the right to receive your personal data in a structured, commonly used, and machine-readable format. Additionally, you have the right to have your personal data transferred directly to another data controller, where technically feasible.
• Objection: You can object to the processing of your personal data when based on our legitimate interests. We will stop processing your data if we cannot demonstrate compelling legitimate grounds that override your rights.
• Lodge a complaint: If you are dissatisfied with how we handle your personal data, you have the right to submit a complaint to a supervisory authority. To find your local authority in the EU, click on this link:
  EU Authorities. For other countries click on this link: National Data Protection Authorities

To exercise your rights, contact us at dataprotection@cbg.com.

Privacy concerns and how to contact usIf you are concerned about an alleged breach of privacy law or any other regulation by us, you can contact us at dataprotection@cbg.com or send a letter to our head office at CBG Konsult & Information AB, Box 1036,
172 21 SUNDBYBERG, Sweden.

Changes to our privacy noticeWe may update this notice to reflect changes in our practices or legal requirements. Please check back periodically to review the latest version.