Information about how LKAB handles personal data
Luossavaara-Kiirunavaara AB (publ), abbreviated to LKAB, (hereinafter referred to as “LKAB”, “we”, “us” or “our”) is the controller for the processing of your personal data. It is of the utmost importance to us that your privacy is protected when you use our services. Here you will find information about which personal data we collect about you, why we collect it and how we use it. Please feel free to contact us if you have any questions (see contact details at the bottom of the page).
The processing of your personal data takes place in accordance with the provisions of the General Data Protection Regulation (also known as GDPR).
1. Personal data collected
From job applicants
We process the personal data you provide us when applying for a position and in your application documents (including any appendices), for the purpose of processing your application. The personal data provided to us includes your name and contact details. As an applicant, you are responsible for the accuracy of the information that is provided to us and that is stated in your application.
We process the personal data necessary to enable us to fulfil our obligations and to safeguard our rights as an employer. The personal data processed includes:
- identification information (such as name, personal identity number and employee number),
- contact details (such as address and telephone number),
- information required for administration purposes, salary and tax payments (such as bank details and information relating to various benefits), insurance matters and social insurance cases (relating to ill health, for example),
- details of next of kin, position within the organisation and agreement sector, as well as of the immediate manager,
- details of skills acquired and information from development reviews,
- information about entry to and exit from our sites and facilities, and
- in some cases images and location information.
From those who work at one of our customers, suppliers or business partners
We process your name, telephone number, mobile number, email address, address, title, role and job description, as well as other personal data that may need to be processed in order to achieve the purposes described below.
From visitors to our facilities/sites
We process your name, information about the company you represent and in some cases contact details and images. During your visit, your entry and exit times and location may also be recorded. At those facilities and sites where camera surveillance is in operation, images of you may be recorded (see more details below).
Camera surveillance of those present at/entering LKAB’s facilities/sites
Camera surveillance is in operation at a number of locations: within industrial sites and facilities, as well as at strategic barriers and passageways to and from such sites and facilities.
The personal data processed as part of camera surveillance consists of images of individual natural persons.
From visitors to our public website
When you register a profile on our website or contact us in any other way to subscribe to information or to order printed information
We process the following personal data: name, address, email address, company (if you choose to enter one), user name, password and details of your subscription and order.
When you communicate with us, via a form on our website or by email, for example
When you communicate with us, we process the information that you provide to us, such as your name and contact details and information about your question, comment or case.
In the event of statutory requirement or dispute
The data processed is that which is necessary in order to fulfil the statutory requirement in question or to protect our interests in the event of a dispute. This personal data may include, for example, names, contact details and personal identity numbers.
2. Identity and contact details of the controller
LKAB’s parent company is the controller for all the personal data that is processed within the context of the business. LKAB determines the purposes and means for each individual processing.
Our contact details can be found under the heading Contact Details below.
If you have any questions about the processing of personal data, you can contact the GDPR coordinator at the following email address: GDPR@lkab.com
3. Purpose, legal basis and storage period
We process your personal data for the following purposes in connection with your job application and/or during your employment:
- To enable us to process and examine your job application (in order to create an information dossier, for example).
- To enable administration of statutory and contractual rights and obligations during your employment in the capacity of employer (such as paying salaries, verifying working time and identifying you within the organisation).
- Personal data deriving from your employment is stored for as long as LKAB requires the data for the purposes for which processing is carried out and/or to comply with legal obligations and to handle any legal claims associated with the employment.
Legal basis for the processing: The processing is necessary to enable us to fulfil our obligations and to protect our rights on the basis of the contract of employment entered into with you (or which is intended to be entered into with you on the basis of a job application) and on the basis of contractual agreements such as pension agreements, salary reviews, etc. Your personal data may therefore be processed in HR administration systems. The processing may also be based on an obligation imposed on us by law or other regulation (known as legal obligation). For example, we have a legal obligation to store certain information during and after your employment.
In some cases, the processing may be based on legitimate interest; for example if we need to process data because of legal claims. When you apply for a job, the processing may be based on your agreement to our processing of your personal data in a certain way, known as consent. During your employment, consent may be used as a legal basis for processing personal data in exceptional cases, such as in the event that we wish to publish an image of you on our internal or external website.
We process your personal data for the following purposes in connection with applications for authorisation and visits to industrial sites/mines/facilities
To enable the examination and administration of: applications for authorisation and access; applications for and use of entry cards, keys, underground tags and vehicular access. To ensure that only those persons who are entitled to be on the site, and in different areas of the site, are able to access the site; to guarantee your safety and that of others and to protect our property. In relation to the above applications and uses, you register yourself the personal data that is required for examination and administration. The personal data is stored for as long as the need exists (in the case of entry cards, for example, for as long as there is a need to access a certain facility).
Legal basis for the processing: The processing is required in order to comply with the legal obligations relating to the work environment and/or which are designed to ensure that only sufficiently qualified personnel are allowed access to certain areas. The processing of personal data in relation to access control is necessary in order to protect our interest in knowing who has access to and is present on our sites; among other things, in order to ensure safety and security. In this case, the processing of your personal data is therefore based on our legitimate interest in protecting access and confidentiality.
We process your personal data for the following purposes when you work at one of our customers, suppliers or business partners
To fulfil obligations and safeguard rights relating to contracts (or prospective/terminated contracts) with your employer or client and to carry out various kinds of administration of tasks relating to such contracts. The personal data is stored only for as long as is necessary in order to fulfil the aforementioned purposes.
Legal basis for the processing: The processing is necessary in order to fulfil obligations and protect rights relating to contracts with customers, suppliers or business partners, as well as for the negotiation and various kinds of administration of such contracts. Processing may also be necessary in order to protect our interests under the contracts and where our interest in processing is deemed to outweigh the possible violation of the privacy of an individual (known as legitimate interest).
We operate camera surveillance for the following purposes
To facilitate the passage of vehicles and persons to and from industrial sites and facilities, to prevent and investigate accidents and other safety incidents, to ensure that only authorised persons are admitted to our sites and facilities and to prevent and investigate crimes. Material recorded by cameras is not kept for longer than is necessary in order to fulfil the purpose of the camera surveillance.
Legal basis for the processing: We consider the company’s interest in processing personal data through camera surveillance for the specified purposes to outweigh the violation of privacy that a surveilled person may suffer. The camera surveillance is therefore based on legitimate interest (which constitutes the legal basis for the surveillance). If persons enter our sites and facilities without authorisation, there is a risk of safety and security incidents, which may affect both the individual who is attempting to gain unauthorised access to the site and employees and others who are legitimately on the site in question.
We process information about your visit to our website for the following purposes
We process the personal data in order to evaluate and improve the website, to understand how visitors use the website and to ensure the functionality of the website. The personal data is stored for as long as is necessary in order to fulfil the aforementioned purposes, but for no longer than 24 months.
Legal basis for the processing: The processing of personal data for the purposes described above takes place on the legal basis of legitimate interest. The processing is necessary for our legitimate interest in being able to provide a secure and user-friendly website that has content relevant to the visitor.
We process your personal data for the following purposes when you register a profile on our website or contact us in any other way to subscribe to information or to order printed information
We process the personal data to enable the administration of your order and the delivery of the information you have ordered. We store your personal data for up to 12 months after your subscription has ended or your order has been delivered so as to ensure traceability in your communications with us.
Legal basis for the processing: The processing of personal data for the purposes described above takes place on the legal basis of legitimate interest. The processing is necessary for both our and your legitimate interest so that you receive the information you have ordered.
We process your personal data for the following purposes when you communicate with us, via a form on our website, for example, or by email
We process personal data to enable us to answer your question, address your comment or handle your case. We strive to minimise data storage, but the length of time for which we keep the personal data depends on the purpose of the processing in question.
Legal basis for the processing: The processing of personal data for the purposes described above takes place on the legal basis of legitimate interest. The processing is necessary for both our and your legitimate interest in handling your question, comment or case.
We process your personal data for the following purposes in connection with the statutory requirements incumbent upon us or in the event of a dispute
The purpose may be based on legal requirements or other regulatory requirements that apply to us. We may also process your personal data in order to establish, assert or defend our legal claims. We store the data for as long as we have an obligation to do so or for as long as the dispute is ongoing.
Legal basis for the processing: The legal basis for the processing is that the processing is necessary for compliance with a legal obligation or for our legitimate interest in establishing, asserting or defending our legal claims.
4. Internal and external recipients of personal data
LKAB may disclose your personal data to other companies within the group where this is required.
LKAB may also disclose your personal data to external recipients, such as public authorities and employee organisations, where required to do so by any legal obligation. Personal data may also be transmitted to companies and other legal entities for other reasons; if LKAB has engaged any such legal person as an assistant/contractor, for the performance of a specific task for example. In such a case, however, LKAB must enter into a data processing agreement with the legal person in order to ensure that the latter processes the personal data in the manner prescribed in legislation and any instructions.
5. Your rights
You have a number of rights under the General Data Protection Regulation.
Right to information
You have the right to receive information about when and how your personal data is processed. You have the right to receive information about the processing at the time when your personal data is collected as well as at your request.
Right of access to your personal data
You have the right to be informed, by means of a register extract, of which personal data about you we process, how this data is processed, the purpose of the processing and the recipients or categories of recipients to which we disclose the data about you.
A register extract will usually be provided to you no later than one month from the date of receipt of your request.
In some circumstances, the information contained in a register extract either cannot or may not be disclosed, because of the provisions of other legislation, for example, or where disclosure could be detrimental to a third party.
Right to rectification
You have the right to request the rectification of inaccurate personal data that is processed by us. If you are an employee, you have access to certain personal data about you that is registered in our HR system, such as your address and telephone number, and you are therefore able to correct this.
If you have applied for a job with us, you are responsible for ensuring that the personal data you provided in your application was correct at the time of application. We will not correct such data.
Right to erasure of personal data/right to be forgotten
Personal data must be erased in the following cases:
- If the data is no longer necessary in relation to the purposes for which it was collected.
- If the processing is based on your consent and you withdraw your consent.
- If the processing is carried out for the purpose of direct marketing and you object to the processing of the data.
- If you object to the processing of personal data that is carried out on the legal basis of the exercise of official authority or legitimate interest and there are no legitimate interests that outweigh your interests.
- If the personal data has been unlawfully processed.
- If erasure is required for compliance with a legal obligation.
- If the personal data relates to a child and has been collected in connection with the child creating a profile on a social network.
- If data is erased at your request, we must also inform those with which we have shared your data about such erasure. This does not apply, however, where it proves impossible or excessively burdensome for us to do so. You also have the right to request information about who we have shared your data with.
There are exemptions from the right to erasure and the obligation to inform others, where this is necessary in order to safeguard other important rights such as the right to freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority.
Former employees cannot request to be forgotten if LKAB is required to retain the personal data in order to comply with a legal obligation. Should a request for erasure be submitted, a dialogue must take place between LKAB as controller and you requesting the erasure of personal data.
Right to restriction of processing
In some cases, you have the right to require the processing of your personal data to be restricted. This means that the data is marked so that from now on it can only be processed for certain specified purposes.
The right to restriction applies in situations such as where you believe the data to be inaccurate and request rectification. In such cases, you may also request that the processing of your data be restricted while the accuracy of the data is investigated.
You have the right to be informed when the restriction ends.
Right to object to the processing
You have the right, in certain cases, to object to our processing of your personal data. The right to object applies when personal data is processed for the performance of a task carried out in the public interest or in the exercise of official authority or on the basis of legitimate interest.
If you object to the processing in such cases, we may only continue to process the data where we are able to demonstrate compelling legitimate grounds for the processing of the data which override your interests, rights and freedoms or where the processing takes place for the establishment, exercise or defence of legal claims.
You always have the right to object to your personal data being used for the purposes of direct marketing. Such objection may be made at any time. If an objection is made to processing for direct marketing purposes, your personal data may no longer be processed for such purposes.
Special rules apply to personal data that is processed for scientific or historical research purposes or statistical purposes.
Right of data portability (the right to have personal data transmitted to another enterprise)
If you have provided your personal data to us, you have the right, in certain cases, to obtain and use your personal data elsewhere (right to data portability). A prerequisite for this is that your personal data is processed on the basis of consent or for the performance of a contract. This right applies only to such personal data that you have provided to us.
Right to lodge a complaint
If you believe that we have processed your personal data in an incorrect manner, you have the right to lodge a complaint to the supervisory Authority.
6. Contact information
LKAB, org. nr. 556001-5835, address Box 952, 971 28 Luleå, Sweden, e-mail: email@example.com, phone number +46771760000, is the controller of your personal data. LKAB:s is responsible for that the processing of personal data is carried out according to applicable laws.
If you have any questions about the processing please contact LKAB by e-mail to: GDPR@lkab.com