1. Introduction – what are personal data?
”Personal data” are all types of information that can be related directly or indirectly to a living natural person. Vattenfall AB is the personal data controller of the data that you provide or that we retrieved from another source. Vattenfall AB always processes personal data with the greatest respect for personal integrity. The guidelines applied by Vattenfall AB, methods for managing and storing information and your rights are described below. The guidelines never restrict the rights that apply according to the Data Protection Regulation or any other legally binding provision. Contact details for the personal data controller and data protection officer can be found under Contacts.
2. Collection of personal dataWe collect personal data using the following methods:• You personally enter your data, such as when becoming a customer and other situations. For example, via our website, on physical forms, in contacts with customer services or sales, by e-mail, letter, contact forms and through login services.• You personally provide your data to a supplier of price comparison services or an electricity agreement intermediary for the purpose of them entering into an electricity agreement with us on your behalf.• Information is created based on your purchases, how you use our services, how you consume electricity and/or heat and when you submit a support ticket to us.• We may also retrieve data about you from other third party sources.We collect the following data from third parties:- Contact details and demographic data from public sources.- Data regarding credit ratings from banks or credit institutions.- Data from other players in the energy industry with the purpose of enabling electricity supplier changes and moves.- Data from our partners.- Personal data that are received from the relevant grid owner or other third parties, as necessary and permitted collected in order to comply with obligations under The Energy Act and regulations given under The Energy Act. ost.
2.1 Vattenfall’s websites
Normally, www.goincharge.com can be visited without triggering collection of personal data. In these cases, we only collect information that is used for statistical purposes and the visitor remains anonymous. Such information may include time of visit, duration of visit and which pages were accessed. In addition, Vattenfall AB uses so-called cookies to enable proper functioning of certain website functions and services. When customers visit Vattenfall’s login services, the visit can be connected to the logged in person’s customer number or user name. This allows Vattenfall AB to conduct more relevant and personal communication with individual customers.
2.2 Personal data categoriesThe following categories of personal data are normally collected:• Customer information, that is, the requisite information for becoming a customer. For example, name, address, flat number, property designation,
phone number, e-mail address, choice of communications channel.• Purchase information, that is, purchased products and services, credit rating, payment history, customer number and password.• Technical information, that is, your electricity and/or heating consumption, electricity and grid supplier, plant number, issues and interruption history and type of connection.• Service information, that is, specific ticket correspondence, information on purchases and any complaints or claims. Customer survey results and feedback on our products and services. Where applicable, data obtained through competitions.• Demographic information (from public records), that is, age, gender, housing area, household demographics, etc.• Website traffic information of login services, that is, purchase and usergenerated data, password, technical data of the device used, interaction data (duration of visit, response times, access and log out methods, etc.)• If you have consented to the recording of a phone call, we may record conversations for the purposes of training of our staff and quality assurance. • Special categories of personal data (defined in Article 9(1) of the General Data Protection Regulation) are only processed in exceptional cases, subject to your consent, except from occasions in which we are legally obligated to collect and process these types of sensitive personal data.
2.3 Data collection informationWhen we collect personal data, the data subject providing the data will receive the following information:• which Vattenfall company is responsible for processing the personal data,• the purpose for and legal grounds on which the personal data is collected,• contact details for the personal data controller and data protection officer,• your rights,• how long the data will be stored.Should you find this information to be unclear or incomplete, we ask that you contact Vattenfall AB to obtain complete information.
2.4 Purpose and legal ground for processingWe only collect personal data for purposes that are supported in the current General Data Protection Regulation. Most commonly, data are collected for processing to support the legal ground for fulfilling the agreement.Examples of purposes:• to enter into an agreement with us/become a customer• to receive a quote for a promotional offer• to purchase a product/service• to manage customer service queries.With our legitimate interest as grounds, we may anonymize your personal data• to develop and improve our products and services• for statistics and analysesOn the basis of our legitimate interests, we also process our customers’ personal data, to the extent permitted by Norwegian law, for marketing and profiling, that is, to communicate relevant offers to our clients and for sales of our own goods and services. If you do not have an established customer relationship with Vattenfall AB, we will only send you marketing material, including sales offers and newsletters, if and to the extent that you have constented to receiving such marketing material. Other purposes for processing personal data may have their legal ground in legal requirements, i.e. when we must fulfil a legal obligation. Examples of such purposes are processing personal data for invoicing in accordance with accounting legislation or when we inform of changed agreement terms.You can also give consent for processing in certain cases when none of the above applies. The provision of consent is an affirmative action on your part and can be withdrawn. We will then discontinue processing your personal data for that purpose.We do not process personal data for purposes that are inconsistent with the original purpose. More information on the purpose for which personal data are used can also be provided when the data is collected, for example, in connection with e-mail forms or in agreement terms.
3. Transfer of personal dataBecause the Vattenfall Group shares some functions, your personal data may be passed on to other companies in the Group to the extent necessary for the administration of our normal business operations. These companies may only process your data with the purpose of providing offers and marketing of products and services that may interest you, if and to the extent that you have consented thereto.
Under certain circumstances, to the extent that we have a valid legal basis for it, we may also pass on personal data to personal data processors, partners or another third party.The parties that may process collected personal data are:• IT suppliers• Customer support suppliers• Sales partners/other partners• Installers (e.g. of solar panels or heat pumps)• Technical service contractors• Telemarketing companies• Printing and digital communications partners• Media and advertising agencies
In the case of transfer, Vattenfall AB takes due consideration of the laws and regulations that regulate the unbundling of electricity retail companies and grid operators (so-called ”unbundling rules”). This entails that personal data cannot always be transferred to another Vattenfall company, even at the request of the data subject. In certain cases, we may be obligated by law or authority decision to pass on personal data to e.g. the police, for crime prevention and criminal investigation.Personal data is not normally provided to companies in countries outside the EU or EEA. In certain situations, the data may be passed on to and processed in countries outside the EU/EEA by companies within the Vattenfall Group or by another supplier or subcontractor. In such cases, a particular investigation is conducted to ensure that the legal conditions are fulfilled and that technical and organisational measures have been taken to ensure that personal data are processed securely and with an adequate level of protection that is comparable to the level of security offered in the EU/EEA. Personal data is not transferred outside the EU/EEA unless the transfer can be made in accordance with the requirements set out in Chapter 5 of the GDPR.
4. Personal data retrieved from other partiesCredit checks are normally performed for new agreements. A search and identification of a person and their address are performed by sending the person’s personal identification number (nw: fødselsnummer) to a credit institute.For the sales of electricity agreements, products and services, we obtain personal data from Bisnode and other public sources with the purpose of discovering target groups for our offers. We do this to enable us to provide offers that are suitable to the recipient and to avoid, as far as possible, sending irrelevant offers. We also use demographic data provided by Bisnode for analyses and statistics. We may also purchase personal data from other sources, primarily to discover target groups for our offers. This processing is based on the individual having requested an offer or entered into an agreement with us through the source or, that the individual has given the source his/her consent to transfer data to us.Partners may send information about you that you have provided to the partner, thereby giving consent to transferring the information to Vattenfall AB as a result of your interest in becoming our customer or to obtain an offer from us.We receive your personal data from Kivra if you receive digital mail from them or make invoice payments through them.
5. Access to personal dataOnly those who need access to personal data to perform the agreed service will be given authorisation to access and process the data. Several of our subcontractors process personal data to different degrees, but all have the same requirements for processing as specified in Vattenfall AB’s internal requirements.
6. RetentionWe do not keep personal data for longer than necessary. When your electricity contract is terminated and you are no longer our customer, we retain your data for 36 months in order to ensure that we can maintain our rights and obligations in connection with any claims or disputes that may occur in connection with the electricity contract. The same applies to data regarding representatives of our corporate customers.However, certain data may be retained for longer in order to fulfil other legal requirements, such as accounting legislation that dictates that information must be retained for 7 years. There is also reason to save data for a longer period of time in the case of an ongoing investigation or dispute, even if the customer relationship has ceased, or in the case that you bought a product that requires us to save information in order to fulfil our warranty.
7. SecurityWe take special physical, technical and organisational measures to protect the personal data that are processed to ensure that the data are not lost, destroyed, manipulated or subjected to unauthorised access. The measures aim to achieve a suitable security level with respect to available technology. Changes to personal data are continuously registered to ensure traceability of all changes made to the information.Personal data breaches are always managed in accordance with internal processes, reported to The Swedish Data Inspection Authority, where applicable, and to the individual in accordance with the General Data Protection Regulations. If you suspect a personal data breach – please contact Vattenfall’s Customer Service (see contact details below).
8. Your rights
8.1 Right of accessEach individual is entitled to receive information on the extent to which his/her personal data are processed by Vattenfall AB. If such personal data are kept by Vattenfall AB, the person concerned may request information on the categories of personal data that are processed, from where they were obtained, for what purpose they are processed, what the legal grounds are for processing and with whom data has been shared. Vattenfall AB will send a transcript to the address registered with Vattenfall AB within 1 month from receiving the request.
8.2 Right to rectificationEach individual has the right to request rectification of their own customer information if it is incorrect or processed contrary to applicable law.
8.3 Right to erasureVattenfall AB deletes personal data when legal grounds for keeping the data no longer exist. Our customers are entitled to immediate deletion of their personal data if any of the following apply:• processing is based only on your consent, and you have revoked that• the data are no longer necessary for the purposes they were processed• the processing is for the purpose of direct marketing and you object to your data being used for this purpose• the information has not been processed in accordance with the regulations• you object to processing after your interest is deemed to override the legitimate interest of the controller• deletion is required to meet a legal obligation.
8.4 Right to object to automated decision-makingVattenfall does not use automated decision-making in any area regarding the individual.
8.5 Right to data portabilityEach individual who has personal data registered with Vattenfall has the right to receive their personal data in a commonly used and machinereadable format for e.g. transfer to another party. Usage history is provided via the export to Excel function under the My Profile pages.
8.6 Right to restriction of processingIn certain cases, you have the right to demand that the processing of your personal data be restricted For example, this applies when you have determined that your personal data is incorrect and you have demanded correction. While the investigation is ongoing, you can demand that the processing of your personal data is restricted.
8.7 Right to objectIf Vattenfall AB processes your personal data with legitimate interest as ground, you can make objections to the processing. In order to do so, you must specify what type of processing you object to. For us to be able to continue processing this way, we must be able to show that there are legitimate reasons for processing your personal data that override your interests.
8.7.1 Marketing, newsletters and profilingWhen personal data are to be processed for the purpose of direct marketing or newsletters, it is indicated when the personal data are collected and your consent is requested if required by Norwegian law. You can, at any time, unsubscribe from receiving marketing material from us by contacting our customer service. You can also limit the channel(s) by which you wish to receive marketing material (e-mail, text message, letter). All of our e-mails and text messages contain a link through which you can unsubscribe to that particular channel.Personal data can also be processed as a part of customer relations management, e.g. through selection and segmentation, we can communicate target group-adapted, relevant and personal offers or to enable better, directed service. As part of this, profiling may take place based on the personal data we received when the customer entered into an electricity contract with us, directly or indirectly (contracts entered into via price comparison services or through designation from Vattenfall Eldistribution AB) as well as based on data we obtained from public records. If you have consented to the use of your personal data for these purposes, profiling is done to better target offers and information that to your preferences, purchasing behaviours, needs and lifestyle. You can, at any time, notify us that you do not wish to receive this type of offers.
8.8 Right to compensationYou may have a right to compensation in certain cases, such as if our processing of your personal data has led to damages for you. Claims can be made directly to Vattenfall AB.
8.9 LinkingInformation on this page applies to Vattenfall AB and to the www.goincharge.com/se website. For more information on personal data processing, etc. in other Vattenfall companies, refer to each respective company and their websites.Should this website contain links to other websites in or outside the Vattenfall Group, the information does not generally apply to those websites. Nor does Vattenfall AB take responsibility for the contents of such websites.
8.11 ContactsThe controller is Vattenfall AB, corporate identity number 556036-2138.The data protection officer for Vattenfall AB can be reached via e-mail at firstname.lastname@example.org or by phone at +46 (0)8-739 50 00. Questions concerning the Vattenfall Group’s personal data processing can be put to our data protection officer or via the general contact form on the website.Send requests for register entries to:Vattenfall Kundservice AB
PO Box 13
880 30 Näsåkeror by e-mail to email@example.comTelephone: 227 30 100
We obtain personal data from SPAR (www.statenspersonadressregister.
se/), UC (www.uc.se/) and Bisnode (www.bisnode.se). For information on
their data controller and data protection officer, refer to their websites.
AppealsShould you be dissatisfied with a decision following an appeal to Vattenfall, you can turn to the Vattenfall Customer Ombudsman by phone on +46 (0)8-739 70 31 or at firstname.lastname@example.org.Contact with the supervisory authority via www.datainspektionen.se or following a name change to www.integritetsskyddsmyndigheten.se.