Information about how LKAB processes personal data
Luossavaara-Kiirunavaara AB (publ) and/or the other company/companies in the LKAB Group which process your personal data (referred to below as: "LKAB", "we", "us" or "our") are, either individually or jointly, controllers with respect to the relevant personal data processing. It is of the utmost importance to us that your privacy is protected when you use our services. Here you will find information about which personal data we collect about you, why we collect it and how we use it. Please feel free to contact us if you have any questions (see contact details at the bottom of the page).
The processing of your personal data takes place in accordance with the provisions of the General Data Protection Regulation (also known as GDPR).
1. Personal data collected
From job applicants
We process the personal data you provide us with when you apply for a job, including the data you provide in your application documents (including any attachments), as well as any personal data which is produced through your contact with us in connection with the application process; in order to administer your application. The personal data provided to us includes your name and contact details. As an applicant, you are responsible for the accuracy of the information you provide us with.
We process the personal data that is necessary to enable us to fulfil our obligations and to safeguard our rights as an employer. The personal data processed includes:
- identification information (such as name, social security number and employee number),
- contact details (such as address and telephone number),
- information required for administrative purposes, salary and tax payments (such as bank details and information relating to various benefits), insurance matters and social insurance cases (relating to ill health, for example),
- details of next of kin, position within the organisation and agreement sector, as well as of the immediate manager,
- details of skills acquired and information from development reviews,
- information about entry to and exit from our sites and facilities,
- information in process and production systems, as well as case management and report management systems,
- information in e-mail conversations, and in minutes and other similar reports,
- information that is required in order to use entry cards, e.g. in order to pay for meals and fuel,
- in some cases, images, log data, location data and data derived from video conference and telephone meetings.
For more information about the personal data processing that is carried out during your employment, see LKAB's business system (Laws and other requirements: GDPR).
From those who work at one of our customers, suppliers or business partners
We process: name, telephone number, e-mail address, address, title, role and job description. Data concerning entry and exit to/from our sites and facilities are recorded, in some cases along with location data, video and audio recordings, and camera surveillance recordings (see below for more information). Furthermore, personal data is processed as necessary in order to administer/manage matters within the framework of agreements with customers, suppliers and/or business partners, as well as any personal data which may need to be processed in order to fulfil the purposes described below. With regard to the processing of personal data for those working for LKAB on behalf of a supplier, information about our data processing can also be found in the Supplier Handbook.
Information for investors about our personal data processing can be found here: Information for investors
From visitors to our facilities/sites
We process your name, information about the company you represent and in some cases contact details and images. During your visit, your entry and exit times and, in some cases, location data may also be recorded. At facilities and sites where camera surveillance is in operation, images of you may be recorded (see more details below).
Camera surveillance of those present at/entering LKAB’s facilities/sites
Camera surveillance is in operation at a number of locations: within industrial sites and facilities, as well as at strategic barriers and passageways to and from such sites and facilities.
The personal data processed as part of camera surveillance consists of images of individual natural persons.
From visitors to our public website
When you communicate with us, register a profile on our website or contact us in order to subscribe to information, the data you provide (such as name, contact details and the details of your case) will be processed.
In the event of statutory requirement or dispute
The data processed is that which is necessary in order to fulfil the statutory requirement in question or to protect our interests in the event of a dispute. This personal data may include, for example, names, contact details and personal identity numbers.
2. Purpose, legal basis and storage period
We process your personal data for the following purposes in connection with your job application and/or during your employment:
- To enable us to process and examine your job application (in order to create an information dossier, for example). Under the Swedish Discrimination Act, we are required to store all of your application documents for two years after the position you applied for is filled. Unless you express a wish for the data to be stored longer, the data will be deleted after this time. If you have applied for several positions, the period begins from the position most recently applied for.
- To enable the administration of statutory and contractual rights and obligations during your employment in the capacity of employer (such as paying salaries, verifying working hours, dealing with social insurance issues and reporting information to the Swedish Tax Agency and other authorities).
Your personal data will also be processed to enable LKAB to manage and allocate work within the Group, to manage your authorisations, to enable other people within the Group to contact and communicate with you, and to enable you to use essential systems (such as production or case management systems) and your entry card. Your personal data will be processed when you use location services so that, in the event of an accident, LKAB will be able to determine your location within LKAB's facility.
Personal data deriving from your employment is stored for as long as LKAB requires the data for the purposes for which processing is carried out and/or to comply with legal obligations and to handle any legal claims associated with the employment. Longer storage periods are needed, for example, for pension analyses or future work injury investigations.
Legal basis for the processing: The processing is necessary to enable us to fulfil our obligations and to protect our rights on the basis of the contract of employment entered into with you (or which is to be entered into with you on the basis of a job application) and on the basis of contractual agreements such as collective agreements, pension agreements, salary reviews, etc. Your personal data may therefore be processed in HR administration systems. The processing may also be based on an obligation imposed on us by law or other regulation (known as legal obligation). For example, we have a legal obligation to store certain information during and after your employment.
In some cases, the processing of personal data during your employment may be based on a balance of interests, for example if we need to process data; in an entry system, in connection with communication and documentation, or in the context of a case management system. In connection with job applications, the processing will be based on a balance of interests, where it is considered that our interest in processing the personal data outweighs any possible interest in not processing the data.
We process your personal data for the following purposes in connection with applications for authorisation to industrial sites/mines/facilities and in connection with visits to the aforementioned sites:
To enable the examination and administration of: applications for authorisation and access; applications for and use of entry cards, keys, underground tags and vehicular access. To ensure that only those persons who are entitled to be on the site/facility, and in different areas of the site/facility, are able to access the site/facility; to guarantee your safety and that of others and to protect our property. In relation to the above applications and uses, you register yourself the personal data that is required for examination and administration. The personal data is stored for as long as the need exists (in the case of entry cards, for example, for as long as there is a need to access a certain facility). Your personal data will be processed through the use of location services so that, in the event of an accident, LKAB will be able to determine your location within LKAB's facility.
Legal basis for the processing: The processing is required in order to comply with legal obligations which concern to the work environment and/or which are intended to ensure that only sufficiently qualified personnel are granted access to certain sites/facilities.
The processing of personal data in relation to access control is necessary in order to protect our interest in knowing who has access to and is present on our sites; among other things, in order to ensure safety and security. In this case, the processing of your personal data is thus based on a balance of interests where our legitimate interest in processing the personal data in order to ensure, for example, access protection outweighs any possible interest in not processing the data.
We process your personal data for the following purposes when you work at one of our customers, suppliers or business partners:
To enable us to fulfil our obligations and safeguard rights relating to contracts (or prospective/terminated contracts) with your employer or client and to carry out various kinds of administration of tasks relating to such contracts. Your personal data is also processed to enable LKAB to manage and allocate the work within the Group and to verify your authorisations, and to enable other persons within the Group to contact and communicate with you. Your personal data will, in some cases, be processed through the use of location services, so that LKAB will be able to determine your location on LKAB’s site/facility, particularly in the event of an accident or for other safety/security reasons. The personal data will only be retained for as long as is necessary in order to fulfil the aforementioned purposes.
Legal basis for the processing: The processing of your personal data is necessary to enable us to safeguard interests relating to our business. Any invasion of privacy that you suffer is deemed to be outweighed by our interest in processing your data (balance of interests). The processing may also be necessary to enable us to implement measures relating to prospective, current and terminated agreements with the company/organisation of which you are an employee or contractor.
We operate camera surveillance for the following purposes:
To facilitate the passage of vehicles and persons to and from industrial sites and facilities, to prevent and investigate accidents and other safety-related incidents, to ensure that only authorised persons are admitted to our sites and facilities, to prevent and investigate criminal offences, and to safeguard production and logistics processes for planning, efficiency and security reasons. Material recorded by cameras is not kept for longer than is necessary in order to fulfil the purpose of the camera surveillance.
Legal basis for the processing: We consider our interest in processing personal data through camera surveillance for the specified purposes to outweigh the invasion of privacy that a person under surveillance may suffer. The camera surveillance is therefore based on legitimate interest (which constitutes the legal basis for the surveillance).
If persons enter our sites and facilities without authorisation, there is a risk of safety and security incidents, which may affect both the individual who is attempting to gain unauthorised access to the site and employees and others who are legitimately on the site in question.
We process information about your visits to our public website for the following purposes:
When you visit our website, some data about your activities will be saved on the page. As mentioned above, the data that can be saved comprises information about the IT equipment you use, your IP address and cookies. We will not normally be able to identify you through the data that is stored. We process the data in order to evaluate and improve the website, to understand how visitors use the website and to ensure the functionality of the website. The data will be stored for as long as is necessary in order to fulfil the aforementioned purposes, but for no longer than 24 months.
We process your personal data for the following purposes when you register a profile on our website or contact us in any other way to subscribe to information or to order printed information:
We process the personal data to enable the administration of your order and the delivery of the information you have ordered. We store your personal data for up to 12 months after your subscription has ended or your order has been delivered so as to ensure traceability in your communications with us.
Legal basis for the processing: The processing of personal data for the purposes described above takes place on the legal basis of a balance of interests. The processing is necessary for both our and your legitimate interest in ensuring that you receive the information you requested. Th abovementioned interests are deemed to outweigh any interests in not processing the data.
We process your personal data for the following purposes when you communicate with us, via a form on our website, for example, or by email:
We process personal data to enable us to answer your question, to address your comments and to process your case. We strive to minimise data storage, but the length of time for which we keep the personal data depends on the purpose of the processing in question.
Legal basis for the processing: The processing of personal data for the purposes described above takes place on the legal basis of a balance of interests. The processing is necessary for both our and your legitimate interest in dealing with your question. It is considered that the interest outweighs any interests in not processing the data.
We process your personal data for the following purposes in connection with the statutory requirements incumbent upon us or in the event of a dispute:
A legal obligation to process your personal data may be based on legal or regulatory requirements to which we are subject. We may also process your personal data in order to establish, assert or defend legal claims. We store the data for as long as we have an obligation to do so or for as long as the dispute is ongoing.
Legal basis for the processing: The legal basis for the processing is that the processing is necessary for compliance with a legal obligation or for our legitimate interest in establishing, asserting or defending our legal claims.
In the case of employees, other forms of personal data processing other than those referred to above may take place. For such processing of personal data, the organisational unit within LKAB that is responsible will provide you with the necessary information.
4. Internal and external recipients of personal data
LKAB may disclose your personal data to other companies within the Group as and when necessary for administrative or other purposes of relevance to the Group’s activities.
LKAB may disclose your personal data to external recipients, such as public authorities and employee organisations, as and when it is required to do so as a result of a legal obligation. Personal data may also be transmitted to companies and other legal entities for other reasons; if LKAB has engaged any such legal person as an assistant/contractor, for the performance of a specific task for example. In such a case, however, LKAB must enter into a data processing agreement with the legal person in order to ensure that the latter processes the personal data in the manner prescribed in legislation and any instructions.
5. Your rights
You have a number of rights under the General Data Protection Regulation (GDPR).
Right to information
You have the right to receive information about when and how your personal data is processed. You have the right to receive information about the processing at the time when your personal data is collected as well as at your request.
Right of access to your personal data
You have the right to be informed, by means of a register extract, of which personal data about you we process, how this data is processed, the purpose of the processing and the recipients or categories of recipients to which we disclose the data about you.
A register extract will usually be provided to you no later than one month from the date of receipt of your request.
In some circumstances, the information contained in a register extract either cannot or may not be disclosed, because of the provisions of other legislation, for example, or where disclosure could be detrimental to a third party.
Right to rectification
You have the right to request correction of inaccurate personal data. If you are an employee, you have access to certain personal data about you that is registered in our HR system (such as your address and telephone number). You will therefore have access to correct the data yourself.
If you have applied for a job with us, you are responsible for ensuring that the personal data you provided in your application is correct at the time of application. We will not correct such data.
Right to erasure of personal data/right to be forgotten
Personal data must be erased in the following cases:
- If the data is no longer necessary in relation to the purposes for which it was collected.
- If the processing is based on your consent and you withdraw your consent.
- If the processing is carried out for the purpose of direct marketing and you object to the processing of the data.
- If you object to the processing of personal data that is carried out on the legal basis of the exercise of official authority or legitimate interest and there are no legitimate interests that outweigh your interests.
- If the personal data has been unlawfully processed.
- If erasure is required for compliance with a legal obligation.
- If the personal data relates to a child and has been collected in connection with the child creating a profile on a social network.
If data is erased at your request, we must also inform those with whom we have shared your data about such erasure. This does not apply, however, where it proves impossible or excessively burdensome for us to do so. You also have the right to request information about who we have shared your data with.
Exemptions from the right to erasure and the obligation to inform others may, in some cases, apply where this is necessary in order to safeguard other important rights (such as the right to freedom of expression and information) or if it is necessary to enable us to fulfil a legal obligation.
Should a request for erasure be submitted, a dialogue must take place between LKAB as controller and you as the person requesting erasure.
Right to restriction of processing
In some cases, you have the right to require the processing of your personal data to be limited to certain specific purposes only.
You may, for example, request that the processing be restricted until the accuracy of the data has been investigated following a request for rectification made by you. You have the right to be informed when the restriction ends.
Right to object to the processing
You have the right, in certain cases, to object to our processing of your personal data. The right to object applies when personal data is processed on the basis of a balance of interests.
If you object to the processing, we may only continue to process the data where we are able to demonstrate compelling legitimate grounds for the processing of the data which override your interests, rights and freedoms or where the processing takes place for the establishment, exercise or defence of legal claims.
You always have the right to object to your personal data being used for the purposes of direct marketing. Such objection may be made at any time. If an objection is made to processing for direct marketing purposes, your personal data may no longer be processed for such purposes.
Right to data portability (the right to transfer personal data)
If you have provided your personal data to us, you have the right, in certain cases, to obtain and use your personal data elsewhere (right to data portability). A prerequisite for this is that your personal data is processed on the basis of consent or for the performance of a contract. This right applies only to such personal data that you have provided to us.
Right to lodge a complaint
If you believe that we have processed your personal data incorrectly, you have the right to lodge a complaint with the Swedish Data Protection Authority.
6. Contact details
Luossavaara-Kiirunavaara AB (publ) and/or the other company/companies within the LKAB Group which process your personal data are, either individually or jointly, the controller(s) in respect of the personal data processing concerned.
The following company has been appointed as a single point of contact regarding the processing of personal data by companies within the Group: Luossavaara-Kiirunavaara AB (publ), org. no. 556001-5835, with address Box 952, 971 28 Luleå, e-mail address firstname.lastname@example.org and telephone number 0771 760 000.
If you have any questions about personal data processing within the Group, you can contact LKAB’s GDPR coordinator via the e-mail address GDPR@lkab.com.