Privacy policy

What is personal data?
Vattenfall's general guidelines for personal data
Collection of personal data
Objectives and legal grounds for processing
Transfer of personal data to third party
Data retention
Security
Your data protection rights
Changes to the personal data provisions
Reporting security vulnerabilities through responsible disclosure

What is personal data?

Personal data may be collected when you contact the Vattenfall Group. Personal data may also be obtained from other sources. “Personal data” means any information relating to an identified or identifiable living individual.

Vattenfall is the data controller for the personal data it receives. This privacy policy explains how the Vattenfall Group processes and stores personal data and outlines your rights in relation to that processing. Nothing in this policy limits any rights you may have under the GDPR or other or other legally binding provisions.

Contact details for the data controller and Vattenfall’s Data Protection Officer can be found under “Contacts”.
Up

Vattenfall’s general guidelines for personal data

The general requirements for the processing of personal data are set out in Vattenfall’s Group Management System and apply throughout the Vattenfall Group.

The Vattenfall Group always processes personal data in a manner that respects individuals’ privacy. Special categories of personal data are processed only where there is a valid reason for doing so. Personal data is shared with third parties outside the Vattenfall Group only where the relevant legal requirements have been met.

Individual Vattenfall companies may have their own policies and procedures that supplement the Group’s general requirements. National Vattenfall websites may also include additional provisions that apply in the relevant country.

See below for information on how personal data is processed in relation to job applicants.
Up

Collection of personal data

Vattenfall collects personal data for example when you visit group.vattenfall.com, when data is provided to Vattenfall via post, email, telephone, etc., or when Vattenfall collects data from public registers.

Vattenfall’s websites

Group.vattenfall.com can normally be visited without personal data being collected. We only collect information used for statistical purposes and the visitor remains anonymous. Examples of such information is the time for the visit, how long the visit lasted and which websites are visited.

Vattenfall uses so called cookies to ensure that functions and services at group.vattenfall.com shall function properly.
Up

Information when data is collected

When personal data is collected by the Vattenfall Group, the person providing his/her personal data will receive information about:

• Which Vattenfall company is responsible for the processing of personal data
• For what purpose and legal ground the personal data is collected, and what interest Vattenfall has in matters where the processing is based on legitimate interests
• Who is the recipient of the personal data and any transfers to third countries
• Contact information to the data controller and data protection officer
• His/her rights in connection with the processing performed
• The right to withdraw consent and to file complaints to the supervisory authority
• Information required for the person providing his/her personal data to be able to exercise his/her rights
• How long the data is stored

If you consider the information to be unclear or incomplete, please contact Vattenfall for complete information.
Up

Objectives and legal grounds for processing

Vattenfall only collects personal data for purposes permitted under applicable data protection legislation. For example, personal data may be processed to provide a service, such as sending newsletters that an individual has requested or subscribed to, where the legal basis for processing is the fulfilment of an agreement. For other purposes, Vattenfall may process personal data on the basis of its legitimate interests. Such purposes may include conducting statistical analysis.

Individuals may also consent to certain types of personal data processing. Consent can be withdrawn at any time. In such cases, Vattenfall will stop processing the personal data covered by that consent.

Vattenfall does not process personal data for purposes that are incompatible with the original purpose for which it was collected. Further information about the purposes for which personal data is used is provided at the time the data is collected, for example when an online form is completed.
Up

Transfer of personal data to third party

As Vattenfall has several group-wide functions, personal data may be shared with other companies within the Group. Where such sharing takes place, the company takes into account the specific laws and regulations governing the separation of electricity trading companies and electricity grid companies (known as unbundling rules). As a result, personal data cannot always be transferred to another Vattenfall company, even if requested by the individual concerned.

In certain circumstances, Vattenfall may also transfer personal data to data processors, collaboration partners, vendors or other third parties.

As a general rule, personal data is not transferred to countries outside the EU or EEA. Where such a transfer to a third country is necessary, a specific assessment is carried out to ensure that the relevant legal requirements are met and that appropriate technical and organisational measures are in place to protect the personal data. These measures are intended to ensure a level of protection equivalent to that provided within the EU/EEA.
Up

Access to personal data

Only those who require access to personal data in order to provide the agreed services are authorised to access and manage it. Vattenfall engages a number of subcontractors that process personal data to varying degrees. These subcontractors are required to apply the same standards and requirements for the processing of personal data as Vattenfall applies internally.

Retention

Vattenfall does not retain personal data for longer than necessary. Personal data is permanently deleted when it is no longer required. This may be the case, for example, when a matter has been resolved or when a contractual relationship has ended and all outstanding obligations between the parties have been settled. However, some data may need to be retained thereafter, such as data used for statistics or as required under the bookkeeping act.
Up

Security

Vattenfall undertakes specific physical, technical and organisational measures to protect the personal data being processed so that no data is lost, destroyed, manipulated or made available to unauthorised parties. The measures aim to achieve a sufficient level of security considering the technical capabilities available. Changes in personal data are recorded continuously in order to ensure that traceability exists in all changes of the data that occur.

Personal data breaches are always handled in accordance with an internal process and are, in relevant cases, reported to the Swedish Authority for Privacy Protection (IMY) (Sw. Integritetsskyddsmyndigheten) and to the individual in accordance with the rules set out in the GDPR. If you suspect a potential personal data breach, please contact Vattenfall’s customer service (see contact information below).
Up

Rights

Right of access

Each user is entitled to receive information about and to what extent his/her personal data is being processed by Vattenfall. If such personal data is stored by Vattenfall, the affected person may request information of i.a. which category of personal data is being processed, from where the data was collected, for which purpose(s) the processing takes place, which legal ground the processing covers, storage time and with whom the data is shared. Vattenfall will send an answer to the address where the person is being registered within one month from having received the request.

Right to rectification

Each user is entitled to request rectification of his/her own personal data that is incorrect or being processed in violation of applicable law. Vattenfall is required to take such measures.
Up

Right to erasure

Vattenfall erases personal data when there is no legal ground for keeping the data. 

Your personal data can be erasure if any of the following is true:

• The processing is based solely on consent which is withdrawn
• The data is no longer required for the purposes for which they are being processed
• The processing is done for direct marketing and the person opposes the processing of the personal data
• The data is not processed in accordance with the GDPR
• The person opposes processing that takes place based on balance of interests, and Vattenfall’s legitimate interest does not outweigh the person’s own interest
• Erasure is required in order to comply with a legal obligation

If data is erased upon request, Vattenfall undertakes to inform any third party with whom Vattenfall has shared the personal data.
Up

Right to portability

Each user who has his/her personal data stored by Vattenfall is entitled to request his/her data in a generally used and machine-readable format for transfer to another party, for example.

Right to restriction of processing

Processing of personal data may be restricted upon request by an affected person or upon initiative by the data controller. Restriction means that the personal data will be marked so that it, in the future, may only be processed for specific purposes. The right to restriction applies for example during the time when the processing of personal data is being investigated.
Up

Right to object

If Vattenfall processes personal data based on balancing of interests as a ground, it is possible to object to the processing. In order to do so it must be specified which processing the objection regards. Vattenfall must show that there are legitimate interests outweighing the interest of the individual in order to continue processing his/her personal data.

Marketing

Where personal data is used for direct marketing (DM), this is stated at the time the personal data is collected. Individuals who object to their personal data being used for direct marketing have the right to opt out by notifying Vattenfall, after which the marketing will cease. Individuals may also choose the channels through which they wish to receive marketing communications.

In all direct marketing, Vattenfall matches personal data with blocking registers for direct marketing (via post, email, telephone or the like). Marketing by email only takes place when the individual has given prior consent. All marketing emails include an option to unsubscribe from future communications.
Up

Right to compensation

Individuals may be entitled to claim compensation, for example if Vattenfall’s processing of personal data violates the GDPR and has led to damages to the individual in question. Claims may be made directly to Vattenfall.

Links

The information on this page applies for Vattenfall and the website group.vattenfall.com, unless otherwise stated. For further information regarding Vattenfall’s policy for processing of personal data within other Vattenfall companies, please contact the respective companies and/or visit their potential websites (as listed above). Vattenfall is not responsible for the content of such websites.

Changes to the personal data provisions

If there are changes to the provisions of the Vattenfall Group regarding processing of personal data, it will be announced on this page. The policy may for example change if the law or the application thereof changes. If the processing of personal data has been regulated in an agreement with the customer, the provisions of the agreement apply until they are changed, unless this violates the rights as per the above or are incompatible with law or other legally binding provisions.
Up

Privacy 

About cookies
Information about processing of job applicants personal data

Reporting security vulnerabilities through responsible disclosure

Vattenfall pays much attention to the proper security of its information and communication systems. Despite this, a weak spot may exist or develop: a security vulnerability. Abusing a security vulnerability, or informing third parties about such a vulnerability which could lead to abuse, is illegal.

Vattenfall has adopted governmental recommendations and adheres to the following responsible disclosure rules.

Report a (possible) vulnerability to Vattenfall IT Security by completing the online form. Provide as much information as possible. A report can be made anonymously.

Do not use the security vulnerability (e.g. by copying or modifying data), do not make it known to third parties; any communication will be coordinated by Vattenfall.

If the above conditions have been met, Vattenfall will not report the intrusion of its systems to the respective authority.

In the event of a non-anonymous report, Vattenfall will inform the discloser about Vattenfall’s approach to resolve the vulnerability and will keep the discloser updated on progress.

Depending on the degree of seriousness of the security vulnerability and the quality of the report, Vattenfall may decide to express its appreciation and / or issue public credits to the discloser.

Vattenfall considers security, reliability and honesty as highly important. This applies to Vattenfall’s activities as an energy company as well as to its role in society. Your honest contribution to increasing safety and reliability is highly appreciated!

Vattenfall guarantees that it will not attempt to identify an anonymous discloser, provided that the discloser does not use his / her knowledge about the security leak and that the knowledge is not shared with third parties.
Report a safety or reliability issue here
Up