Privacy Policy
Automation, Press and Tooling, AP&T AB, reg. no 556288-4667 and its subsidiaries (“AP&T”, “we”, “our”, and “us”) care about your privacy. Therefore, we always strive to protect your personal data in the best possible way and to comply with all applicable laws and regulations for the protection of personal data. In this Privacy Policy, we inform you about how we process your personal data and what rights you have.
If you have any questions or if you wish to use any of your rights, you are welcome to contact us at our contact details which can be found here.
In short: How we process your personal data
- If you receive marketing from us, we process your personal data to market our services towards the company you represent.
- If you are depicted in photos and video which we publish, we process your personal data for marketing purposes.
- If you represent a customer, supplier or partner, we process your personal data to enter into agreements and administrate our relationship as well as to comply with bookkeeping legislation. If you represent a customer, we will also process your personal data to send you relevant marketing materials.
- If you interact with us without having a business relationship, e.g. through our social media channels, we process your personal data to communicate with you and respond to your questions.
- If you use our website, we process your personal data to make the website function.
Your rights, in short:
In some cases, your personal data is transferred outside the EU/EEA by our partners and suppliers, which may entail that your personal data having a more limited protection than it has within the EU/EEA. In these instances, we make sure to take measures to protect your personal data. See more information here.
You can access a more detailed description regarding the specific processing of your personal data and your rights by clicking on the links above. Depending on the relationship we have with you, we process your personal data for all or only some of the above stated purposes.
Below you find information about:
- Who is responsible for your personal data?
- Detailed description of how we are processing your personal data
- Your rights
- Who has access to your personal data and why?
- Transfer of personal data to third countries
- Balancing of interests’ assessments when processing personal data based on the legal basis “legitimate interests”
When we refer to “your company” in this Privacy Policy, we refer to your employer or the organization or public body that you represent. We will only process personal data about you in your business role, except in situations when you apply for a job at AP&T. In such cases we describe how we process your personal data in our privacy policy in relation to recruitment.
Who is responsible for your personal data?
A company within the AP&T group of companies is responsible for the processing of your personal data as described in this text. To make it easier for you, when we in the policy use the term "our", "us" or "we" it refers to the company within AP&T Group that is responsible for the processing of your personal data (data controller).
We do not want you to have to research which company within the AP&T Group that you should contact regarding a specific question. Instead, if you have any questions or queries regarding our processing of your personal data or if you wish to exercise any of your rights, you are welcome to contact us at integrity@aptgroup.com, or at Box 32, SE-523 21 Ulricehamn, Sweden. You can always contact a specific company within the AP&T company group that you interact with by using their contact details which you find here.
In detail, the responsibility as data controller is as follows:
- As a rule, the company within AP&T group of companies that you interact with is responsible for the processing of your personal data, i.e. acts as data controller. The list of AP&T Group entities and their contact information is available here.
- However, the company within the AP&T group that contact you for marketing purposes is joint controller together with Automation, Press and Tooling, AP&T AB for AP&T for marketing. Therefore, we have entered into an agreement that regulates the joint controllership. We have agreed that Automation, Press and Tooling, AP&T AB is responsible for handling questions and requests from you as a data subject.
Detailed description of how we are processing your personal data
Below you can find a detailed description of why we process your personal data, what personal data we process, when you need to provide the personal data to us and the legal basis for our processing. The legal basis is the basis for processing your personal data according to the GDPR (General Data Protection Regulation). We make sure to only process your personal data in a way that is necessary based on our relationship. Below you will also find information about the duration of our processing of your personal data.
Not all information below is relevant for you and therefore we have provided the information under different headlines. Read the headlines that are relevant for you, i.e. based on how you come in contact with us.
I receive marketing from AP&T
In the tables below you find information about how you receive marketing from us we you or your company have shown interest in our services or if you have chosen to subscribe to our newsletters. We get your personal data directly from you or from your company.
| To market our services towards the company you represent | ||
|---|---|---|
| Purpose | Personal data | Legal basis |
If you have shown interest in our services or if your company is a customer to us Market us towards the company you represent, e.g. by e-mail and calls. Store information about interesting business leads and potential partners and suppliers. | - Name. - Contact information as phone number and e-mail address. - Information about which organization you represent. - Your language preference. - Information you provide to us during our calls, e-mails etc. | Legitimate interest (Article 6.1 (f) GDPR) If you have shown interest in our services, your personal data will be processed based on our legitimate interest to market our services towards the company you represent which we consider could be interested in our services or to have a business relationship with us. If your company is one of our customers, your personal data will be processed based on our legitimate interest to send you information, invitations and other marketing that is relevant for your organization. |
If you have chosen to subscribe to our newsletters Send you newsletters. | - E-mail address | Consent (6.1 (a) GDPR) We process your personal data based on the consent that you provide when you sign up for our newsletters. |
| If you have stated that you do not wish to receive marketing from us, we will store such information in an “unsubscribe-list” to make sure we do not send any marketing to you. Our purpose is to comply with the marketing legislation. | - Name - E-mail address | Legal obligation (6.1 (c) GDPR) The processing is necessary to comply with legal obligations which we are subject to, i.e. marketing law, which require us not to send marketing material to individuals who have objected to receiving such marketing. We cannot make sure you will not receive marketing from us without processing your personal data for this purpose and you are therefore required to provide your personal data to us. |
Storage period: We will register you as a potential lead first when you have shown some interest in our marketing efforts, e.g. when your company becomes a customer to us or when you yourself starts to subscribe to our newsletters. You can choose to unsubscribe or object to receiving information and marketing at any time. If you object to receiving marketing from us, we keep track of this in our “unsubscribe-list” until further notice to avoid sending you any further marketing material. | ||
I am depicted in photos and video which AP&T publish
In the tables below you find information about how we process your personal data if you participate in pictures or videos which we publish. We ourselves take the footage or receive it from you.
| To publish photos/videos | ||
|---|---|---|
| Purpose | Personal data | Legal basis |
Publish photos and videos at our website and or social media channels for marketing purposes. Your personal data will only be processed for this purpose after you have chosen to participate in the footage. | - Your image, either in photos or video material | Legitimate interest (Article 6.1 (f) GDPR) Your personal data will be processed based on our legitimate interest to be able to share this type of footage for marketing purposes. |
| Storage period: The footage will stay published until you ask us to delete it. | ||
I represent a customer, supplier or partner
In the tables below you find information about how we process your personal data when your company is our customer, supplier or partner. If your company is our customer, we as well will market our services to you as described above.
We primarily collect your personal data directly from you. Additionally, your personal data may be obtained from your company if they designate you as their representative.
| To enter into an agreement with your company and administrate our relationship | ||
|---|---|---|
| Purpose | Personal data | Legal basis |
Discuss and enter into an agreement with your company. Thereafter, to administer our relationship with your company, e.g. for the purpose of invoicing and communication with our customer, supplier or partner. | - Name - Information about which organization you represent and position in your company - Contact information, e.g. telephone number and e-mail address - Other information you provide us in agreements or in our communication | Legitimate interest (Article 6.1 (f) GDPR) Your personal data will be processed based on our legitimate interest to negotiate and enter into an agreement with your company and to administrate our relationship with your company. |
Storage period: Your personal data will be deleted if we conclude that we will not enter into an agreement with your company and your company does not want to keep in contact with us. If your company becomes our customer, supplier or partner, we will store your personal data for this purpose as long as the company you represent is our customer, supplier or partner and for a period thereafter in order to evaluate our previous business relationship and/or potential future business relationship. We will as well delete your personal data if we receive information that you no longer represent the company. However, your personal data may still be processed in agreements, invoices, and similar documents where your name appears. | ||
| To comply with accounting legislation | ||
|---|---|---|
| Purpose | Personal data | Legal basis |
| Store information in accounting material. | - Name - History regarding payments made - Other information that constitutes accounting records | Legal obligation (6.1 (c) GDPR) The processing is necessary to comply with legal obligations to which we are subject, i.e. accounting legislation. You need to provide us with this information, otherwise, we will not be able to administrate our relationship with your company. |
Storage period: We will retain any documents considered accounting material, along with the personal data contained within them, in accordance with the storage period specified by accounting legislation. In Sweden for example, this means that your personal data will be stored for a period of seven to eight years. According to Swedish regulation we need to store accounting material until and including the seventh year after the end of the calendar year for the fiscal year to which the personal data relates. | ||
I interact with AP&T without having a business relationship
If you are in contact with us we will process your personal data as described in the table below. We receive the personal data from you yourself or from your company, along with information from your social media account, should you use such an account for communication.
When contacting us through a social media channel, we recommend familiarizing yourself with the privacy information of that specific platform.
| To communicate with you | ||
|---|---|---|
| Purpose | Personal data | Legal basis |
| Communicate and answer your questions, e.g. via e-mail, social media or if you have filled out the contact form at our website. | - Information you provide to us, e.g. name, which company you represent and contact information - If you communicate via our social media channels, we also process information from your profile on the social media in question (username and any picture you have chosen for your account) | Legitimate interest (Article 6.1 (f) GDPR) Your personal data will be processed based on our legitimate interest to communicate with you once you have contacted us. |
Storage period: Your personal data will be stored for as long as necessary to communicate with you. If your organization become a customer, supplier or partner to AP&T, your personal data will be processed as stated above. Your comments and communication with us on our social media channels can be deleted by you at any time. We will remove posts or comments which are in breach of the rules of the platform or in conflict with legislation as soon as possible. | ||
I use AP&T’s website
If you visit or otherwise use AP&T’s website, e.g. login to your account, we will process your personal data as described in the tables below. We collect your personal data from you.
| To provide a functioning website | ||
|---|---|---|
| Purpose | Personal data | Legal basis |
- Make sure that our website works in a satisfying and secure manner and adapt the website to your device To do this we use cookies and/or similar technologies that collect information regarding your device. Do you want to read more about how we use cookies? You find a more detailed description of this in our information about cookies. | - IP-address including which country the internet connection is from - Information about your device, e.g. type of device such as smartphone or computer and what web browser you use - A pseudonymized account- ID that identifies you as a unique visitor | Legitimate interest (Article 6.1 (f) GDPR) The personal data is processed based on our legitimate interest to provide a functioning website. |
| Storage period: The personal data used to provide a functioning website will be processed during your visit of the website and until you close your browser. | ||
I or my company have queries, complaints or similar
We always strive to maintain a good relationship with your company and to answer all questions you or your company may have. If you or your company have any questions or would like to make a complaint regarding one of our services, we will process your personal data as described below. We will either collect your personal data directly from you or your company or collect the information ourselves.
Please note that the ongoing matter might prevent us from deleting all your personal data immediately upon your request.
| To handle any queries, complaints or similar | ||
|---|---|---|
| Purpose | Personal data | Legal basis |
Handle any queries, complaints or similar. To defend ourselves against complaints. | We will only process the personal data necessary to handle a specific case, that can be: - Name | Legitimate interest (Article 6.1 (f) GDPR) The personal data is processed based on our legitimate interest to handle a question, complaint and/or legal dispute in which you are the representative of a customer, supplier or partner. |
| Storage period: We will store your personal data from the initiation of the matter and throughout the duration of any potential dispute. | ||
Your rights
You have certain rights that you can exercise to affect how we process your personal data. You can read a more detailed description about what those rights are below.
If you want to know more about your rights or if you want to exercise any of your rights, please contact us and we will help you.
Right to lodge a complaint with a supervisory authority (Article 77 GDPR)
You have the right to lodge a complaint with the relevant supervisory authority. Here you can contact the Swedish Supervisory Authority. To find contact information to your relevant supervisory authority, please see a list here.
In detail: Your right to complain exists without prejudice to any other administrative or judicial remedy. You have the right to lodge a complaint with a supervisory authority in the EU/EEA member state of your habitual residence, place of work or place of where the alleged infringement of applicable data protection laws has allegedly occurred.
The supervisory authority has an obligation of informing you on the progress and the outcome of the complaint, including the possibility of a judicial remedy.
Right to withdraw consent (Article 7.3 GDPR)
You have the right to withdraw your consent at any time by contacting us. Any withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal.
Right to access (Article 15 GDPR)
You have the right to obtain confirmation as to whether we are processing personal data concerning you or not. You can make such a request by contacting us. If we do process your personal data, you also have a right to obtain a copy of the personal data processed by us as well as information about our processing of your personal data.
In detail. The information we provide includes the following:
- the purposes of the processing,
- the categories of personal data concerned,
- the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations,
- where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period,
the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing, - the right to lodge a complaint with a supervisory authority,
if the personal data are not collected from you, we provide you with available information about the source of the personal data, - the existence of automated decision-making, including profiling, referred to in Articles 22.1 and 22.4 GDPR and, in those cases, meaningful information about the logic involved, as well as the significance and the predicted consequences of such processing, and
- where your personal data are transferred to a third country or to an international organization, you have the right to information regarding the appropriate safeguards, pursuant to Article 46 GDPR, put in place for the transfer.
For any further copies of the personal data undergoing processing requested by you, we may charge a reasonable fee based on administrative costs. If you have made the request by electronic means the information will be provided to you in a commonly used electronic form, unless otherwise requested by you.
Your right to obtain a copy referred to above shall not adversely affect the rights and freedoms of others.
Right to object (Article 21 GDPR)
You have the right to object to our processing of your personal data at any time. You can make such a request by contacting us.
In detail: Your right to object applies as follows:
- You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is necessary for the purposes of our legitimate interest (Article 6.1 f GDPR), including profiling based on that provision. We shall no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.
- Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where you object to processing for direct marketing purposes, you have an unconditional right to have the processing of your personal data for such purposes ceased. - In the context of the use of information society services, and regardless of Directive 2002/58/EC (ePrivacy Directive, or ePD), you may exercise your right to object by automated means using technical specifications.
Right to erasure (“the right to be forgotten”) (Article 17 GDPR)
You can at any time ask us to delete some or all of your personal data. You can make such a request by contacting us.
In detail: We have the obligation to erase your personal data without undue delay where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed,
- you withdraw your consent on which the processing is based, and there is no other legal ground for the processing,
- you object to the processing pursuant to Article 21.1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21.2 GDPR,
- the personal data have been unlawfully processed, or
- the personal data have to be erased for compliance with a legal obligation in Union or Member State law that applies to us.
Where we have made the personal data public and are obliged in accordance with the rights stated above to erase the personal data, we shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
We will notify any erasure of personal data carried out in accordance with your rights stated above to each recipient to whom the personal data have been provided to, unless this proves impossible or involves disproportionate effort. If you want information about those recipients, you are welcome to contact us.
Please note that our obligation to erase and inform according to above shall not apply to the extent processing is necessary according to the following reasons:
- for exercising the right of freedom of expression and information,
- for compliance with a legal obligation which requires processing by Union or Member State law which applies to us, or
- for the establishment, exercise or defense of legal claims.
Right to rectification (Article 16 GDPR)
You have a right to obtain, without undue delay, the rectification of inaccurate personal data concerning you. You can make such a request by contacting us.
In detail: Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
We will communicate any rectification of personal data to each recipient to whom the personal data have been provided to, unless this proves impossible or involves disproportionate effort. If you want information about those recipients, you are more than welcome to contact us.
Right to restriction of processing (Article 18 GDPR)
You have the right to demand restriction of the processing of your personal data. You can make a request by contacting us.
In detail: Your right applies if:
- the accuracy of the personal data is contested by you, during a period enabling us to verify the accuracy of the personal data,
- you have objected to processing pursuant to Article 21.1 GDPR pending the verification whether our legitimate grounds override yours,
- the processing is unlawful, and you oppose the erasure of the personal data and instead request the restriction of their use, or
- you need the personal data for the establishment, exercise or defense of legal claims even though we no longer need the personal data for the purposes of the processing.
Where the processing has been restricted according to above, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
We will notify each recipient to whom the personal data has been provided to about any restriction of processing according to above, if this do not occur to be impossible or entails a disproportionate effort. If you want more information about these recipients, you are welcome to contact us.
Right to data portability (Article 20 GDPR)
You have the right to receive your personal data from us in a structured, commonly used and machine-readable format and, where technically feasible, have your personal data transferred to another data controller (“data portability”). You can make such a request by contacting us.
In detail: The right applies if:
- the processing is based on the lawful basis consent, and
- the processing is carried out by automated means.
The exercise of the right to data portability shall be without prejudice to the right to erasure, i.e. Article 17. Your right to data portability shall not adversely affect the rights and freedoms of others.
Who has access to your personal data and why?
As a starting point, your personal data will only be processed by AP&T, and we do not sell your personal data. This means that your personal data will be handled by our employees, but only by the personnel in need of such access to conduct their work.
We will share your personal data with the following recipients:
- Our IT suppliers will get access to the personal data and other information when developing and supporting our IT system to ensure good and secure IT operations. These IT supporters only process personal data on our behalf and never on their own behalf.
- Your personal data will also be processed by companies within the AP&T Group, as these entities collaborate and utilize the same IT systems, marketing department as well as share information needed for intra-group cooperation, such as information on sales, projects, installations and operations.
- If you receive our newsletters or surveys, we will share your personal data with Inxmail which is a company that helps us send newsletters and surveys.
- If you interact with us on or visit our social media channels, such as LinkedIn, Facebook and YouTube, the social media platform that you use will process personal data about you as a user.
- If you play a video on our website, your personal data will be shared with YouTube, who provides the video platform we use on the website.
If you have any questions regarding how we share your personal data or want to know more about who we share your personal data with, please feel free to contact us.
Transfer of personal data to third countries
As a general principle, AP&T only processes your personal data within the EU/EEA. If your personal data will be processed outside the EU/EEA, then we will make sure that such processing is either based on a decision from the Commission establishing that the country in question ensures an adequate level of protection or appropriate safeguards that ensure that your rights are protected or based on another ground for such transfer in accordance with GDPR.
Your personal data will be transferred outside the EU/EEA in the following cases:
- AP&T employs staff in its subsidiaries located outside the EU/EEA. As we collaborate closely within our organization at AP&T, our subsidiaries outside the EU/EEA will also have access to your personal data.
- To our IT-suppliers that are located outside of the EU/EEA. However, to protect your personal data and minimize the risk of it being transferred outside the EU/EEA, we ensure that your personal data is stored exclusively on servers of our IT suppliers that are situated within the EU/EEA.
- If you visit and communicate with us on our social media channels (e.g. LinkedIn, Facebook (Meta) and YouTube) or play videos on our website (YouTube) your personal data will be transferred outside the EU/EEA. One reason being that many of these companies are based in the United States.
When your personal data is transferred to the UK, we and our suppliers rely on an adequacy decision regarding the UK recognized by the European Commission for the transfer of personal data outside of the EU/EEA. An adequacy decision means that the European Commission has assessed that a particular country has an adequate level of protection for your personal data under Article 45 GDPR. You can find the adequacy decision for the UK here.
We also rely on an adequacy decision regarding most transfers to the US, when our American suppliers are certified under the EU-US Data Privacy Framework. You can find the adequacy decision for the US here. Google (including YouTube), Meta and LinkedIn are certified under the EU-US Data Privacy Framework. By searching on their company names here, you will be taken to the certificate of the respective company.
In the absence of an adequacy decision, or when our transfer is not protected under an adequacy decision, we and our suppliers will instead rely on Standard Contractual Clauses (Article 46.2 c GDPR) module 1 and module 2, and supplementary security measures for the transfer of personal data outside of the EU/EEA. We will rely on the Standard Contractual Clauses when your personal data is processed through for example Youku or WeChat which can transfer your personal data to China. The use of Standard Contractual Clauses is an effort to provide a safe transfer of your personal data. You can find the Standard Contractual Clauses here.
If you want to know more about where your personal data will be processed, please feel free to contact us.
Balancing of interests’ assessments when processing personal data based on the legal basis “legitimate interests”
As we state in the tables above, for some purposes, we process your personal data based on our “legitimate interest”. By carrying out a balancing of interests’ assessment concerning our processing of your personal data, we have concluded that our legitimate interest for the processing outweighs your interests or rights which require the protection of your personal data.
If you want more information in relation to our balancing of interests’ assessments, please do not hesitate to contact us. Our contact information can be found at the beginning of this Privacy Policy.
This Privacy Policy was adopted by AP&T on 2025-07-02.