Start›Privacy Policy

Privacy Policy

Returpack (we/us) cares about your personal integrity, and in this privacy policy, we describe how we handle personal data. We also describe the rights you have under the General Data Protection Regulation (GDPR) and how you can exercise them.

Returpack-Burk Svenska AB with organization number 556218-9117 is responsible for the processing described, and if you have any questions, you can always contact us at dataskydd@returpack.se.

What information do we collect?

We collect the information that you provide to us. You can provide us with information about yourself in several ways, such as when you register on our website, contact us, or use any other of our services.

General information

In this section, you can get an overview description of the personal data processing we perform. In the section "The personal data processing we perform," there is more detailed information about each personal data processing.

When do we process personal data?

We process personal data in various contexts. For example, we need to process personal data to administer deposit refunds. Another example is that we process personal data for contacts at, for example, shops, cafes, and transporters to administer deposit handling and transportation.

How long do we store personal data?

Personal data is only stored for as long as necessary to fulfill the purposes for which the data was collected. We may retain the data longer if required by law.

Who might we share personal data with?

We may share personal data with our other companies or providers of IT infrastructure. We may provide necessary information to authorities such as the Swedish Tax Agency if requested and if we are required to do so by law.

For producers, importers, and transporters, a creditworthiness assessment is made when applying to use the deposit system. In such cases, the organization number is shared with the credit reporting company, which confirms identity and address and conducts the creditworthiness assessment.

Do we transfer personal data outside the EU/EEA?

We always strive to process personal data within the EU/EEA. In some situations, personal data may be shared with recipients, such as system providers, in countries outside the EU/EEA. In such cases, we ensure that there is an adequate level of protection for the personal data during the transfer or that appropriate safeguards have been taken according to applicable legislation.

If you want more information, such as the safeguards taken, you are welcome to contact us at dataskydd@returpack.se

The personal data processing we perform

Administer deposit payment to private person

Purpose	Personal data we process	Legal basis for processing	Recipients of the personal data
Administer deposit payemnt for submitted bins to Returpack To enable the payment of deposits.	When registering on the website, you provide: Name, address, email address, telephone number and bank account number. SEB processes the deposit payment.	Agreement	SEB - The personal data is transferred to SEB. SEB is responsible for the personal data processing they perform.
Administer deposit payment via the Pantamera app To enable the payment of deposits.	In cases where you choose payment via Swish, we collect your social security number and your telephone number, which is transferred to Swish. SEB processes the deposit payment.	Agreement	Swish - Social security number and telephone number are transferred to Swish. Swish and SEB are responsible for the personal data processing they perform.
Storage period We store the personal data for as long as you are an active user. Inactive profiles are deleted after 3 years.
Storage of payment documentation To fulfill obligations under the law (the Accounting Act), we need to retain payment documentation.	Bank account number	Legal obligation
Storage period The current year plus 7 years according to the Accounting Act.

Administer deposit handling, transportation, and material sales

Purpose	Personal data we process	Legal basis for processing	Recipients of the personal data
Administer deposit handling for our customers To administer deposit handling, we process personal data of contact persons at stores, cafes, restaurants, and associations.	Name, telephone number, and email address	Balance of interests. The processing is necessary to fulfill the legitimate interest of administering deposit handling.	IT system provider (data processor).
Storage period Personal data is updated continuously upon changes in contact person and deleted when/if the customer is deleted. For inactive customers, the contact person is deleted after 2 years.
Administer deposit handling for producers’ and importers Producers and importers must be connected to the deposit system, and articles to be included in the deposit system must be reported. We need to process personal data of contacts at producers and importers to administer deposit handling.	Name, telephone number, and email address	Balance of interests. The processing is necessary to fulfill the legitimate interest of administering deposit handling.	IT system provider (data processor).
Storage period Personal data is updated continuously upon changes in contact person and deleted when/if the producer/importer is deleted.
Webshop Administer order and payment of products To be able to deliver ordered products.	Name, telephone number, address, email address	Agreement or balance of interests. The processing is necessary to fulfill the legitimate interest of administering orders and payments.	SVEA - Handles the payment. SVEA is responsible for the personal data processing they perform. Supplier shipping the order (data processor). Supplier managing and developing the webshop (data processor).
Storage period
Administer transportation Contact information for contact persons at transporters and drivers is processed to administer transportation of deposits.	Name, telephone number, and email address	Balance of interests. The processing is necessary to fulfill the legitimate interest of administering transportation.	IT system provider (data processor).
Storage period Personal data is updated continuously upon changes in contact person/driver and deleted when/if the agreement ends.
Administer material sales Administer contracts and sale of materials.	Name, telephone number, and email address	Balance of interests. The processing is necessary to fulfill the legitimate interest of administering material sales.	IT system provider (data processor).
Storage period Personal data is updated continuously upon changes and deleted when/if the agreement ends.

Error handling of deposit machines

Purpose

Personal data we process

Legal basis for processing

Recipients of the personal data

Error handling of deposit machines

Contact support for deposit machine providers in case of errors.

Name, telephone number, and email address

Balance of interests. The processing is necessary to fulfill the legitimate interest of handling errors on deposit machines.

IT system provider (data processor).

Storage period

Personal data is updated continuously upon changes and deleted when/if the agreement ends.

Marketing and competitions

Purpose

Personal data we process

Legal basis for processing

Recipients of the personal data

Administer marketing activities and competitions

For marketing our business and organizing competitions.

Name, email, image, audio, video

Consent

Providers in advertising, media, and communication (data processor)

Storage period

As long as marketing activity is ongoing or competition is completed.

Camera surveillance

Purpose	Personal data we process	Legal basis for processing	Recipients of the personal data
Camera surveillance of facility Certain gates and entrances are monitored by cameras to prevent vandalism and ensure evidence in case of burglary and vandalism.	Video material	Balance of interests. The processing is necessary to fulfill the legitimate interest of camera surveillance of the facility.
Storage period 30 days.
Camera surveillance of intermediate storage The purpose is to get an overview of the amount of goods in bulk storage.	Video material and still images	Balance of interests. The processing is necessary to fulfill the legitimate interest of camera surveillance of the intermediate storage.
Storage period The camera image is updated approximately every 5 minutes and is not stored thereafter.

Cookies

We use cookies on our web services: Here you can read more about how we use cookies.

Your rights

You have several rights under the General Data Protection Regulation. The rights you have depend on the legal basis for the processing of personal data. Below is a description of the rights:

Right to information – As a registered person, you have the right to receive information about how we process your personal data. We inform you through this information and by answering questions from you.

Right to access (record extract) – As a registered person, you have the right to confirm whether we process personal data about you, and you have the right to access the personal data and certain information about the processing.

Right to rectification – As a registered person, you have the right to have incorrect personal data about you corrected, and you have the right to supplement incomplete information.

Right to erasure – As a registered person, you have in some extent the right to have your personal data erased without undue delay. The right to erasure does not apply if the processing is necessary for the exercise of the right to freedom of expression and information, to comply with a legal obligation that requires processing under Union law or the national law of a Member State to which we are subject, or to establish, exercise or defend legal claims. The right to erasure may, depending on the basis of your request, also be limited if the data are still necessary for the purpose or if there are overriding legitimate grounds for the processing than for your right to erasure under Article 21.1 GDPR.

Right to restriction of processing – As a registered person, you have the right to request that processing be restricted if you contest the accuracy of the data, if the processing is unlawful, if the data are no longer needed for the purposes but you need them to establish, exercise or defend legal claims. The right also applies pending verification of whose interests prevail, if you have objected to processing in accordance with Article 21.1 GDPR.

Right to object – As a registered person, you have the right to object to processing based on public interest, exercise of public authority, or legitimate interest. In such a situation, processing ceases unless there are compelling legitimate grounds for the processing that override your interests or if the purpose of the processing is to establish, exercise or defend legal claims.

Right to data portability – As a registered person, you have in certain cases the right to receive data you have provided to us and to have the data transferred to another data controller. The right exists when we process personal data automatically and with your consent or based on a contract.

Right to lodge a complaint – As a registered person, you have the right to lodge a complaint with the supervisory authority if you believe that the processing is in violation of the General Data Protection Regulation. The supervisory authority for our processing of your personal data is the Swedish Data Protection Authority.

You can read more about your rights on the Swedish Data Protection Authority's website.

Contact us

You can always contact us with questions about privacy and data protection by sending an email to dataskydd@returpack.se.

This privacy policy was last updated on 2024-04-24.