PRIVACY NOTICE FOR THE DIG & HMP FAMILY.
The DIG & HMP family of companies (hereinafter “we” or “us”) respects your privacy and values the relationship we have with you. This Privacy Notice describes how we collect, use, disclose and otherwise process personal data, and is aimed for existing and prospective members (including applicants), investors, customers, suppliers or other business partners to one or several family companies, including their respective representatives, signatories and beneficial owners (“you”). Our family of companies is made up of a number of different legal entities and brands, including HMP, DIG Investment, Djursholm Investment Group and Djursholm Country Club. You can learn more about our legal entities and brands here.
WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA?
Since the DIG & HMP family consists of different companies and brands, the company responsible for the processing of your personal data depends on the purpose for which your personal data is processed. For members at the club, Djursholm Country Club AB is responsible for most of the processing, and for prospects and investors, your contracting party is responsible for most of the processing. In some circumstances more than one company will be responsible, for example where information is shared with other family companies for the purpose as set out in this notice.
WHAT KIND OF PERSONAL DATA ABOUT YOU WE PROCESS
We mainly process the following types of information about you:
Contact and identification data: name, date of birth, social security no./pers.id., tax id.no., e-mail address, address, phone number, nationality, ID documents, title/employer information, signature and other contact details.
Financial data: source of wealth, shareholdings, investments, commitments, bank account information, payment information, etc.
Agreement and relationship data: agreements between you and us including all types of information linked to such agreements, correspondence and other information as part of our prospective or existing relationship with you.
KYC data: sanction list data, whether you are a politically exposed person, ID documents, beneficial ownership, etc.
Event and participation data: newsletter requests, event registrations and participation, food preferences, attendance to events, bookings, etc.
LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA
The legal bases we rely upon to process personal data will depend on the purposes for which we are processing the data and are the following:
Entering into or performing a contract. We will process personal data necessary for entering into, performing and administering our business relationship and agreements with you and to fulfil and enforce any rights and obligations derived from such agreements.
Legitimate interest. We may process, and sometimes also share, your personal data when necessary for our legitimate interests as a business, when these interests do not outweigh your own rights and interests. When we process your personal data for our legitimate interests, we make sure to consider and balance any potential impact on you. You have the right to object at any time to processing of your personal data that is based on our legitimate interests.
Legal obligation. In some circumstances, we have a legal obligation to process and also to share your personal data, such as to comply with accounting and book-keeping laws, anti-money laundering and terrorist financing laws, and complying with requests from authorities.
PURPOSES – HOW WE PROCESS YOUR PERSONAL DATA
We may process your personal data for the following main purposes. The scope of processing will depend on the relationship between you and us.
Managing our business operations
Purpose and processing: managing our services, including handling financial management, planning, corporate governance and audit, handling internal records, performing quality controls, ensuring safety and security, establishing exercising and defending our rights, and other activities to run our business. Categories of data: Contact and identification data, Financial data, Agreement and relationship data, KYC data, Event and participation data.
Legal basis: Legitimate interest, Legal obligation
Administering our relationship
Purpose and processing: preparing, managing and maintaining our relationship with you, handling agreements, providing our services and products, administrating payments, processing subscriptions and redemptions, executing corporate actions, handling customer service and answering queries, etc.
Categories of data: Contact and identification data, Financial data, Agreement and relationship data, KYC data, Event and participation data.
Legal basis: Entering into or performing a contract.
Events & networking
Purpose and data processing: to identify new investors and members and maintain relationship with existing members and investors we may get in touch with you to provide updates, market our services and products, invite you to marketing and networking events and similar. For this purpose, and for security reasons, we also keep lists of participants. Note that we may, after having informed you and where you have not objected, share the participation list with joint organizers, partner companies and sponsors of such events.
Categories of personal data: Contact and identification data, Event and participation data
Legal basis: we process your personal data for this purpose based on our legitimate interest to provide and market our services, inform you about events, to organize events and to reach out to you after the event.
Sales & marketing
Purpose and data processing: for purposes of marketing our, and other DIG & HMP family companies’ products and offerings to prospects, potential members and investors we may share and process limited personal data with other DIG & HMP family companies.
Categories of personal data: Contact and identification data
Legal basis: we process your personal data for this purpose based on the legitimate interest of the relevant family company to market services and reach new members and investors
Addressing compliance and legal obligations
Purpose and processing: complying with applicable laws and regulations
Categories of personal data: Contact and identification data, Financial data, Agreement and relationship data, KYC data.
Legal basis: Legal obligation
HOW WE COLLECT YOUR PERSONAL DATA
We collect data from different sources, including:
Information that is provided directly to a DIG & HMP family company. We may receive personal data directly from you in connection with you becoming a member, investor, customer or otherwise in connection with establishing a business or contractual relationship with you. We also collect personal data directly from you in connection with events and through networking activities.
Information provided from other DIG & HMP family companies. We may obtain personal data from other DIG & HMP family companies if considered necessary to fulfil the intended processing purpose, and in particular for administrative purposes, for events & networking and sales & marketing purposes, based on our legitimate interest.
Information obtained from third parties. We sometimes also collect data from publicly available sources such as commercial registers and online databases.
DATA RETENTION
The period we keep your data will vary depending on the purpose for which we process personal data. In general, we keep personal data only as long as reasonably needed to achieve the purposes set out in this Privacy Notice. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the purposes for which we process your personal data, legal requirements or operational retention needs, and whether we can achieve those purposes through other means. Data that is needed for book keeping and accounting purposes is generally retained for 7 years after the closing of the end of the financial year to which they relate. Personal data processed for KYC purposes will be retained for at least 5 and sometimes 10 years after the end of the business relationship. If any legal claims are brought, we may continue to process the personal data for such additional periods as necessary in connection with such claims.
DATA SHARING
We may, in certain situations share data with other parties. Any such sharing is limited to the data relevant for the purpose.
Sharing within the DIG & HMP family. The DIG & HMP family companies support and interact with each other to run our businesses. As a result, we may share limited sets of personal data with another DIG & HMP family company to process for the purposes set out in this Privacy Notice, where there is a legal basis for them to do so, mainly for purposes of offering services and products they consider relevant to you. We require our family companies to protect the personal data in line with this Privacy Notice. You always have the right to object to such sharing.
Data processors. We engage suppliers which process personal data on our behalf and that act as so-called data processors. This is suppliers of IT services and systems, telecommunication providers, CRM system, accounting services, event organizers, logistics providers and similar. Our data processors may only process personal data in accordance with our instructions and are required by law to take appropriate technical and organizational security measures to protect the personal data.
Other data controllers and authorities. We may share personal data with parties who act as independent data controllers and that are independently responsible for their own processing of the personal data, where required by law, where it is necessary to administer the relationship with you or where we have another legitimate interest in doing so. Independent personal data controllers with whom we may share your personal data are:
Banks and similar payment providers and intermediaries
Authorities and other recipients where required to comply with applicable law
Joint event organizers, partner companies and sponsors when we organize events and activities together with external organisers, provided that we have informed you and you have not objected
Legal, audit firms and other advisers
When personal data is shared with a company that is independently responsible for processing the personal data, such company's privacy notice apply.
M&A transactions, reorganizations and other corporate transactions. In the event of a proposed or actual merger, acquisition, reorganization or similar business transaction involving a DIG & HMP family company, data may be shared with a potential buyer or investor.
WHERE WE PROCESS PERSONAL DATA
The personal data is mainly processed in Sweden or other EU and EEA countries, but in some cases we may transfer personal data to recipients in countries outside the EU. To ensure that the personal data is adequately protected, we will take necessary measures such as entering into the EU Commission’s standard contractual clauses, or ensuring that there are other appropriate security measures in place.
YOUR RIGHTS
You have certain rights in relation to how we process your personal data, these rights are:
Right of access. You have the right to request information about the personal data we process about you and get a copy of such data.
Right to rectification and completion. If your personal data is inaccurate or incomplete, you have the right to ask us to correct or complete it.
Right to object to processing for direct marketing purposes. You may at any time unsubscribe to send-outs or other direct marketing activities by notifying us, e.g. by clicking on the unsubscription link in the email or otherwise contact us.
Right to object to processing based on our legitimate interest. You have, in certain instances, right to object to our processing, and we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests.
Right to restriction of the processing. You may request that we restrict the processing of your personal data, e.g. if you consider that the personal data is no longer necessary for the purpose.
Right to erasure. You may in certain instances request us to erase your personal data, e.g. if the personal data is no longer necessary for the purpose of the processing, or if the processing is unlawful.
Right to data portability. In certain cases, you have the right to get a copy the personal data you have submitted to us, transferred to you or to another party.
Right to withdraw consent: If our processing is based on your consent, you have the right to withdraw that consent at any time.
Please note that we are required, due to legal obligations, to retain certain personal data for up to ten years after our relationship has ended.
How to exercise your rights
You can contact us at any time if you have any questions regarding our Privacy Notice or the processing of your data by sending an email to: privacy@hmpfamily.com
Right to complain with a supervisory authority
If you have complaints about how we process your personal data you have the right to make a complaint to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten - IMY).
Updates to our Privacy Notice
We continuously update our Privacy Notice, the latest version is always available on this site.
Latest update 6th December 2023