This Privacy Policy is intended to inform you how your personal data is processed if you either contact us by email or by phone or use our Vikan website https://vikan.com (“Website”) and/or the service My Vikan (“My Vikan”) which is a user platform accessible by registered users and provided through the Website.

A. Data Controller

The Website and My Vikan is provided by Vikan A/S, Rævevej 1, 7800 Skive, Denmark, entered in the Danish Central Business Register (CVR) under registration number 10290147 (“Vikan”, “we” or “us”).

We act as data controller in relation to the Website, My Vikan and if you contact us by email or phone.

Vikan has not appointed a data protection officer (DPO). All questions concerning this privacy policy or the processing of personal data may be directed to privacyprotection@vikan.com.

B. Description of our data processing and its purposes

If you send us an email or call us by phone, we will collect and process your personal data. Our processing is for the purposes of processing your enquiry, including responding to your requests.

Our legal basis for this processing is our legitimate interest (see GDPR Article 6 (1) (f)). The legitimate interests pursued by us is our customer care and the ability to communicate with you.

The data we process will include your name and the contact details you provide to us and such other information you provide to us in relation to your request.

We store the data until we have completed your request and for a retention period of two years

When using the Website, we may collect and process your personal data when you either interact with us or accept our use of cookies. We will specify our processing of your personal data for each of the functions and services you use below:

i) When you accept our use of cookies

Where the Website stores information on or accesses information from end devices (e.g., cookies), we obtain your consent where required by law (the Cookie regulation in Denmark). Without your consent, only technologies strictly necessary to provide the services you expressly request are used.

Please refer to our Cookie Policy for information on our data processing via cookies. Our Cookie Policy is available at https://www.vikan.com/int/cookie-policy or via the footer of each landing page.

ii) Contact forms

When using our contact forms, we process your personal data for the purpose of contacting you to respond to your requests. If we request information, we will specify whether providing the data is voluntary or mandatory in order to complete the requested action.

Our legal basis for this processing is your consent (see GDPR Article 6 (1) (a)).

The data we process will include your name and the contact details you provide to us such other information you provide to us in relation to your requests.

We store the data until we have completed your request and for a retention period of two years. If you have a My Vikan account and we can pair your data with your account, we store the data for two years after you delete your My Vikan account or two years after your latest login to My Vikan whichever is longest

iii) Subscribing to newsletters

When subscribing to our newsletter, we process your personal data for the purpose of sending you our newsletter and for the purpose of documenting your consent to receive electronic marketing.

Our legal basis for this processing is your consent (see GDPR Article 6 (1) (a)) and to comply with a legal obligation (see GDPR Article 6 (1) (c)).

The data we process will include your consent to receive electronic marketing, your name, email address, IP address and the time of you consenting to receive electronic marketing, time of revocation of your consent and when we last send you electronic marketing.

We store the data for two years after you revoke your consent to receive electronic marketing or from our latest use of your permission to send you electronic marketing, whichever is longest.

When using My Vikan, we collect and process your personal data. We will specify our processing of your personal data for each of the functions and services you use below:

i) When you create a user account

When creating a user account in My Vikan, we process your personal data for the purpose of providing access to the My Vikan service based on your request for a user account. This also includes the maintenance of security, integrity and audit logs.

Our legal basis for this processing is performance of a contract (see GDPR Article 6 (1) (b)).

The data we process will include your name, email address, position/title and company and login credentials.

We store the data for two years after you delete your account or two years after your latest login to My Vikan whichever is longest.

ii) When using My Vikan functionality

When you login to My Vikan and start using the provided functionality such as downloading materials, access to materials, use of digital tools timestamps, tool interactions, preferences and outputs generated, we process your personal data for the purpose of customer care marketing, including behavioural marketing. This includes that we track and log your use of the service in order to be able to provide you with relevant marketing information by different means, offer you personalised content or recommendations and provide you with customer support. Our customer care marketing also includes our distributor relationship management.

Our processing under this purpose also includes:

Marketing automation and segmentation

We process your personal data to analyse interactions with our Website, My Vikan and our communications by phone and email for the purpose of lead scoring, grading and segmentation. This includes the use of marketing automation systems to evaluate engagement and to identify leads that may be contacted by Vikan’s sales personnel.

Profiling and automated decision-making

We conducts profiling in the form of lead scoring, grading, segmentation and analysis of interactions with the Website, My Vikan and digital tools. Profiling is carried out for the purposes of tailoring marketing activities, enhancing customer engagement, identifying relevant content and assessing whether a lead may be contacted by Vikan’s sales personnel.

We do not carry out automated decision-making that produces legal or similarly significant effects for you. Any decisions relating to customer relationships, marketing activities or sales outreach involve human assessment.

Our legal basis for this processing is your consent (see GDPR Article 6 (1) (a)).

The data we process will include your identity, technical user information such as IP address, browser and device information, and your usage information relating to your activity within My Vikan, order records and correspondence and other business relationship information.

We also process your personal data for the purpose of improving our tools, products and services based on actual use. This includes that we log your use of the Website and My Vikan to understand usage patterns, learn how our service is used by you, how to improve the services and the general user experience.

Our legal basis for this processing is our legitimate interest (see GDPR Article 6 (1) (f)).

The data we process will include your identity, technical user information such as IP address, browser and device information, and your usage information relating to your activity within My Vikan, order records and correspondence and other business relationship information.

We store the data for two years after you delete your My Vikan account or two years after your latest login to My Vikan whichever is longest.

When processing your personal data, we use service providers to provide the functionality and supporting IT-systems. If service providers (“processors”) process personal data on our behalf, we have concluded a data processing agreement with these processors and agreed appropriate guarantees on safeguarding the protection of personal data. We select our processors with care. They process personal data exclusively for the purposes of fulfilling their responsibilities and are contractually bound by our instructions, have taken suitable technical and organisational measures for the protection of personal data and are regularly monitored by us.

We also share your data such as requests, downloads, access to materials, use of digital tools timestamps, tool interactions, preferences and outputs generated with our Vikan group companies and distribution partners to assist them in their marketing and customer care activities.

Furthermore, personal data necessary to complete a delivery will be disclosed to a carrier chosen by Vikan. Such disclosure will be necessary for the performance of a contract in accordance with Article 6(1)(b) of the GDPR.

We use the processor Salesforce, Inc. in USA to host and process data in the Website and My Vikan backend. With this service provider based in the USA, access to the data from a third country cannot be ruled out. To ensure an adequate level of protection for personal data, Vikan has concluded Salesforce, Inc.’s standard Data Processing Addendum which includes the EU standard contractual clauses and BCR. Salesforce processes your personal data exclusively on our behalf and in accordance with our instructions within the framework of the data processing agreement. The EU standard contractual clauses used can be accessed in the EU languages via the URL https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32021D0914. The Salesforce BCR can be accessed via https://www.salesforce.com/company/legal/privacy/.

Your personal data will in general be deleted when it is no longer needed for the purposes it was collected for. The specific retention times as given above under Section 2 and 3 above. Your personal data may however be processed and stored for a longer period of time, if we are obliged to do so according to law.

Personal data included in accounting records is kept for up to ten years from the end of the financial year to which the records relate.

C. Your rights

You may assert the following rights vis-à-vis Vikan at any time free of charge.

If you assert rights as a data subject, we must check your identity and may ask you for further information or clarification if necessary. We may request this additional information so that we can identify the personal data which concerns you and provide it to you. Furthermore, we must ensure that we do not violate the rights of other vehicle users when providing personal data.

We will reply to your inquiry as soon as possible and within one month at the latest.

To assert your rights as a data subject, please contact Vikan at privacyprotection@vikan.com.

1. Right to information

You have the right to obtain confirmation from us as to whether, and if so which, personal data concerning you is being processed and to which third parties within and outside the EU your data has been disclosed. Furthermore, you have the right to receive a copy of your personal data which has been processed by us.

2. Right to rectification

You have the right to request rectification from us of incorrect or incomplete personal data pertaining to you.

3. Right to erasure

You have the right, in the event that the requirements specified in GDPR Article 17 have been met, to request the erasure of your data. Accordingly, you may request the erasure of your data, for instance, if it is no longer necessary for the purposes for which it was collected. Furthermore, you can also request deletion if we process your data on the basis of your consent and you revoke this consent.

4. Right to restriction of processing

You have the right to request the restriction of the processing of your personal data if the requirements specified under GDPR Article 18 GDPR have been met. This is the case, for example, if you dispute the accuracy of your data. You may then request that processing is restricted for as long as it takes to examine the accuracy of your personal data.

5. Right to object

You have the right to object to the processing of your data:

• If the processing is for direct marketing purposes (including profiling for direct marketing purposes); without giving reasons.

• If the processing (including profiling) is based on the legitimate interests of us or of a third party (GDPR Article 6, paragraph 1, letter f) and we are not in a position to demonstrate compelling reasons for processing worthy of protection which outweigh your interests, rights and freedoms or the processing serves to assert, exercise or defend legal claims. In the event of such objection, you are kindly requested to notify us of your reasons for objecting to data processing.

6. Right to data portability

Provided that the data processing is based on consent or on the fulfilment of a contract and that it is also carried out using automated processing, you have the right to receive your data in a structured, commonly used and machine-readable format and to forward it to another data controller. In addition, you have the right to request that the personal data be forwarded directly from us to another controller

7. Right to withdraw consent

If the data processing is based on consent, you have the right to withdraw your consent at any time free of charge with effect for the future by email to privacyprotection@vikan.com.

The right to withdraw consent at any time, does not affect the lawfulness of processing based on consent before its withdrawal.

8. Right to lodge a complaint

You also have the right to lodge a complaint with a supervisory authority or other competent data protection authority regarding our processing of your data. This may be the data protection authority in your country of residence, or it may be the Danish Data Protection Agency as Vikan is incorporated in Denmark.

The contact information for the Danish Data Protection Agency are available at its website: https://www.datatilsynet.dk.

A list of all data protection authorities in the European Union and the European Economic Area can be found here: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.

***

2026 version, replacing April 2021, version 2.0