Select Your Country or Region

You are now at International (English)
Home / About us / Legal / Privacy policy

Privacy Policy

Introduction

This is one Privacy Notice for Arjo focusing on our business interests. This Privacy Notice relates to the processing of personal data of representatives of customers suppliers, leads and users of the Arjo Academy platform. It provides information to the relevant stakeholders about the who, what, why, when, where and how of our data processing activities, as well as setting out what rights individuals have in relation to these processing activities.

 

Who is processing the personal data?

As indicated above, the data controller for the processing of your personal data is one of Arjo’s many legal entities as part of an international organisation. To make this notice easier to read, Arjo refers to any and all Arjo entities. Appendix A of this privacy notice provides a list of Arjo legal entities to determine to whom these arrangements should be considered applicable.

Arjo aims to be compliant in everything we do. As such, we invite you to contact us whenever you feel it is necessary so we can partner with you in addressing any comments or concerns you might have. We have appointed a Data Protection Lead who is also able to support you with any queries you may have. The data protection lead is:

James Stone

Data Compliance Analyst

dataprivacy@arjo.com.

 

What personal data are we processing?

The type of personal data we may process about you depends on the type of data subject and the nature of our relationship with you, as well as the location where you are. The processing of your personal data could include the following:

Customer Representatives and Contacts

Identifiers
  • Name
  • Job title
Contact data
  • Phone
  • Email
Location data
  • Address
  • IP address

 

Leads and Prospects

Identifiers
  • Name
  • Job title
Contact data
  • Phone
  • Email
Location data
  • Address

 

Supplier Representatives and Contacts
Identifiers
  • Name
  • Job title
Contact data
  • Phone
  • Email
Location data
  • Address
  • IP address

 

Webinar platform users
Identifiers
  • Name
  • Job title
Contact data
  • Email
Location data
  • Address
  • IP address
Audio / visual data
  • Photos (only where provided by the platform user)

Please note, the contact and location data processed relates to data used in a professional capacity and may come directly from you or from the organisation you are working for.

 

Why are we processing personal data?

Arjo processes personal data for the reasons listed below.

Representatives of customers, contacts and suppliers

  • Managing the production and distribution of our products and equipment via our logistics supply chain.
  • To fulfil our customer orders and requests, as well as to provide support to customer representatives in the event of a complaint or issue or handling claims.
  • To manage our legal, regulatory and statutory obligations as well as to maintain accurate and reliable administrative and accounting records, which include managing queries, concerns and investigations.

Leads and prospects

  • The pursuit of our commercial interests through marketing activities.

No automated decision making is undertaken, with the exception of monitoring the success of marketing activities. This includes generating a profile based on the use of our online resources which performs an evaluation. This information is only used to better inform how Arjo can support you. The information is only used for this purpose and no individual data protection or statutory rights are infringed in this process. Any evaluation is subject to human review. If you have any questions or concerns about the potential use of automated decision-making, please contact dataprivacy@arjo.com.

 

Which lawful basis do we use for processing personal data?

Arjo only process personal data if there is a legal basis for the processing. For the processing described in this privacy notice, Arjo uses the following lawful basis for processing:

Lawful basis for processing

Processing activities

Your explicit consent.

You are able to withdraw your consent at any time. You can do this by contacting dataprivacy@arjo.com.

Marketing activities including direct marketing.

Your implicit consent to fulfil our legal obligation or if processing is in our legitimate interests (dependant upon the legislative framework that is applicable).

Activities linked to our regulatory and statutory requirements.

Marketing activities including managing our relationship with you as a contact of Arjo. Processing of customer representatives’ personal data is necessary to manage and distribute products and equipment via our logistics supply chain and to fulfil our customer orders and requests.

 

Where we rely on a legal obligation to justify the processing of your personal data, this is to ensure that our regulatory and statutory requirements are fulfilled. This is important in order to maintain the quality of the service and products that many stakeholders rely on.

There may also be times when legitimate interest is the appropriate justification for processing your personal data. In this situation, we have undertaken a legitimate interests assessment where the needs, expectations, rights and freedoms of all parties have been considered. Before relying on legitimate interest, we have made sure that our interests are compelling enough and will not cause any unwarranted harm.

 

For how long do we process your personal data?

We save information for as long as the information is necessary to fulfil the purposes for which the information was collected. The information can be saved for a longer period of time if it is required by applicable law, such as the European Union Medical Device Regulation. Arjo have established routines to ensure that we do not store unnecessary information about you.

Information regarding representatives of customers and contacts

  • Most commercial, customer or financial information, relating to e.g. purchase, order and order history, is retained for five years.
  • As a global organisation in a highly regulated field, we need to retain information relating to production, distribution, quality, or performance of any of our products for 15 years in accordance with strict European and global regulatory obligations. The personal data contained to these records is usually limited to low risk personal data where there is any personal data at all.
  • Information relating to a customer service case is saved until the matter is resolved and retained in a de-identified format for 15 years.
  • Information collected after consent is saved for as long as it is relevant or no later than within six months after consent is revoked.

Information regarding prospects and leads

  • Information collected after consent is saved for as long as it is relevant or no later than within six months after consent is revoked.

 

Where are we processing personal data and who do we transfer personal data to?

We may on occasion transfer your personal data outside of the country in which we gather your personal data. This may be done through the use of a particular processor. Where this is relevant, we have undertaken privacy impact assessments and transfer impact assessments to identify appropriate additional measures to implement, prior to establishing data processing agreements including approved standard contractual clauses. In the event that the contractual and organisational measures are still inadequate, we will seek your explicit consent to undertake the proposed processing.

Most of our data processing takes place in the EEA.

We use different systems and platforms to manage the data we process, and a list of the key data processors are listed below:

  • Infor.
  • ON24
  • Pardot
  • Sage
  • SalesForce
  • SAP
  • Sparta Systems.

Additionally, we use Microsoft Office storage and productivity tools to process personal data in the course of our commercial, production, logistical, operational, research and administrative activities.

We may also share personal data with partners and in line with our regulatory or statutory obligations. In all instances, data will only be shared in line with an appropriate lawful basis for processing. Data sharing is frequently undertaken following a privacy impact assessment and a transfer risk assessment to ensure the necessary safeguards and control measures are in place prior to any data sharing.

 

How are we processing personal data?

Arjo have adapted the following to enable secure and compliance towards handling and processing data:

  • Arjo have an IT policy, Information Security Directive, Data Privacy and Acceptable Use of IT devices Directive.
  • Access management based on least privilege with access reviews performed on a quarterly basis, additionally each user will have unique and individual usernames where none are shared.
  • Admin access only given to system and database owners who have the correct skills and training, normally senior IT staff.
  • Robust change management process.
  • All systems for which the hosting solution is determined by Arjo can only be accessed via our VPN solution. In all cases, all data and systems are encrypted at rest and in transit, and require a unique username and password to access the data each user is authorised to access.
  • All Third Parties that host or work on Arjo systems are subject to a Risk Assessment on a yearly basis.
  • Arjo also have an overall Incident management process which is run by our Service Management team.
  • Patch management; as part of our service management.
  • Pen testing and vulnerability management.
  • IT audits performed by a third party annually.

 

What are your rights in relation to this data processing?

Depending upon the data protection laws of the country you are in or the legal entity processing your personal data, you may have rights including:

  • Your right of access – You have the right to ask us for copies of your personal information that we process about you. Through this copy you will be able to understand which of your personal data we have and process. The right of access is applicable when a record contains information where an individual can be identified, and the information is about them. This means that records that are accessible to you will have the personal data about other people redacted where appropriate, in order to protect their right to privacy. Your personal data will be redacted if someone else requests access to a record containing your personal data. Legislation provides other exemptions that may be applicable such as records where legal privilege needs to be observed or there is an obligation of confidentiality in specific circumstances. Any exemption applied will have a relevant legal basis and will be explained to you were necessary.

 

  • Your right to be informed – You have the right to be informed of how we process your personal data. This Privacy Notice is an initial means of informing you about the processing of your personal data. Additional methods of keeping you informed include through FAQs, contractual agreements and through discussions – if you have a question about how we are processing your personal data, you can contact us by writing to dataprivacy@arjo.com.

 

  • Your right to rectification – You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. Any request to rectify your personal data will also be transferred and actioned by any processor with whom your personal data has been shared. This process is managed by us and will not require any additional action from you for your right to be exercised in full.

 

  • Your right to erasure – You have the right to ask us to erase your personal information when the information is no longer necessary to fulfil the purpose of processing the information or keeping it or if you retract your consent. Arjo is obliged to keep extensive records in accordance with our legal obligations. As such, Arjo may not be able to delete every record that is processed about you, however this will be explained where relevant. Any request to be forgotten will also be managed by Arjo with any processor that is processing your personal data on our behalf.

 

  • Your right to restriction of processing – You have the right to ask us to restrict the processing of your information in certain circumstances such as if the personal data is not relevant to fulfil our legal obligations.

 

  • Your right to object to processing – You have the right to object to the processing of your personal data. The right can be invoked when the legal basis is legitimate interest, including profiling. If an objection is made, Arjo must show compelling legitimate interests to continue processing personal data for that specific purpose.

 

  • Your right to data portability – You have the right to ask that we transfer the information you gave us to another organisation. This enables you to transfer it in a machine-readable format to another recipient. The right to data portability applies to personal data that is processed based on your consent or to perform a contract. It applies only to such personal data that you have provided Arjo with yourself.

 

  • Your right regarding automated decision-making – You have the right to request that a review of any profiling that is undertaken using your personal data to be undertaken by a human.

 

  • Your right to withdraw consent – You have the right to withdraw consent where this is the lawful basis established for the processing of your personal data i.e. when collected for certain marketing activities.

For more information about your specific data protection rights, please visit the website of your local data protection authority. Appendix A provides a list of the data protection authorities for the locations where Arjo have a legal entity, along with the relevant contact details.

You are not required to pay any charge for exercising your rights in most instances. If you make a request, we have one month to respond to you.

Please contact us by email if you wish to make a request.

Finally, you have the right to complain to a data protection authority. As above, Appendix A contains a comprehensive list of the data protection authorities for each Arjo legal entity, along with contact details.

The main establishment of Arjo is in Malmö, Sweden. Therefore, our supervisory authority is Integritetsskyddsmyndigheten (IMY).

IMY’s contact details are:

Integritetsskyddsmyndigheten

Box 8114, 104 20 Stockholm

0046 (0)8-657 61 00

imy@imy.se.

 

Country

Arjo entity

Address

Phone number

Data protection authority

Phone number

Email address

Address

AE imagez30oh.png

Arjo Middle East FZ-LLC

P.O Box 11488, Dubai

+971 487 48053

DIFC

+971 4 362 2222

commissioner@dp.difc.ae

The Gate, Level 14, DIFC

P.O. Box 74777, Dubai

AT imagedcq3i.png

Arjo Austria GmbH

Lemböckgasse 49A, 1230 Wien

+43 1 8 66 56

DSB

+43 1 52 152-0

dsb@dsb.gv.at

Barichgasse 40-42, 1030 Wien

AU imagekos5p.png

Arjo Australia Pty Ltd

Level 3, Building B, 11 Talavera Road, Macquarie Park NSW 2113

+61 1800 072 040

OAIC

+61 1300 363 992

enquiries@oaic.gov.au

GPO Box 5218, Sydney NSW 2001

BE images6e0e.png

Arjo Belgium nv/sa

Evenbroekveld 16

9420 Erpe-Mere

+32 53 60 73 80

APD-GBA

+32 2 274 48 00

contact@apd-gba.be

Rue de la Presse 35 – Drukpersstraat 35

1000 Bruxelles – Brussel

BR imagefrfjb.png

Arjo Brazil

Rua Marina Ciufuli Zanfelice, 329 - Prédio 2 Lateral - Lapa, São Paulo - 05040-000, SP

+55 11 3588-5088

ANPD

+55 (61) 3411-5961

anpd@anpd.gov.br

Esplanada dos Ministérios, Bloco C, 2º andar, CEP 70297-400 – Brasília – DF

CA imagek92ud.png

Arjo Canada Inc.

90 Matheson Blvd, Unit 350

Mississauga. L5R 3R3 Ontario

+1 905 238 7880

OPC

+1 819-994-5444

Online form

30 Victoria Street, Gatineau, Québec, K1A 1H3

CA imagex3no.png (Quebec)

ArjoHuntleigh Magog Inc.

2001, Tanguay

Magog, J1X 5Y5, Quebec

+1 819 868 0441

CAI

+1 418 528-7741

cai.communications@cai.gouv.qc.ca

525 Bd René-Lévesque E, Québec, G1R 5R3

CH imageyfbvw.png

Arjo AG

Fabrikstrasse 8 CH-4614 Hagendorf

+41 61 337 97 77

FDPIC

+41 (0)58 462 43 95

info@edoeb.admin.ch

Feldeggweg 1, CH-3003 Berne

CN imagey00v.png

Arjo (Suzhou) Medical Equipment Trading Co.,Ltd

No. 158 Fangzhou Road,

SIP, Suzhou, Jiangsu, 215024

+86 512 6956 0787

CAC

+86 (010) 8805 0686

N/A

225 Chaoyangmennei Da Jie, Beijing, China, 100010

CZ imageryyo2.png

Arjo Czech Republic s.r.o.

Na Strži 1702/65

140 00 Praha 4

+420 225 092 388

UOOU

+420 234 665 111

posta@uoou.cz

Pplk. Sochora 27, 170 00 Praha 7

DE blobid1.png

Arjo Deutschland GmbH

Peter-Sander-Str. 10 55252 Mainz-Kastel

+49 6134 1860

BfDI

+49 228 997 799 0

poststelle@bfdi.bund.de

Graurheindorfer Straße 153, 53117 Bonn

DE  imageud5zq.png(Hesse)

Arjo Deutschland GmbH

Peter-Sander-Str. 10 55252 Mainz-Kastel

+49 6134 1860

HBDI

+49 611 1408 0

poststelle@datenschutz.hessen.de

Postfach 3163, 65021 Wiesbaden

DK imagead95.png

Arjo AS

Vassingerødvej 52 3540 Lynge

+45 4913 8486

Datatilsynet

+45 33 1932 00

dt@datatilsynet.dk

Carl Jacobsens Vej 35

2500 Valby

ES imagefznug.png

Arjo Ibérica S.L.

Poligono Can Salvatella

c/ Cabanyes 1-7, 08210 Barberà del Valles, Barcelona

+34 900 921 850

AEPD

+34 91 266 3517

internacional@aepd.es

C/Jorge Juan 6, 28001, Madrid

FI image0vvc7.png

Arjo Sverige AB

Box 48, Hans Michelsensgatan 10, 201 20 Malmö, Sweden

+46 10 335 4500

Tietosuojavaltuutetun toimisto

+358 29 566 6700

tietosuoja@om.fi

Lintulahdenkuja 4, 00530 Helsinki

FR imageo7azt.png

Arjo France S.A.S.

2, Avenue Alcide de Gasperi  CS 70133, 59436 Roncq Cedex

+33 3 20 28 13 13

CNIL

+33 1 53 73 22 22

Online form

3 Place de Fontenoy

TSA 80715, 75334 Paris Cedex 07

HK imagemo2tc.png

ArjoHuntleigh (Hong Kong) Limited

Room 411-414, 4/F, Manhattan Centre, 8 Kwai Cheong Road, Kwai Chung, N.T.

+852 2960 7668

PCPD

2827 2827

communications@pcpd.org.hk

Unit 1303, 13/F, Dah Sing Financial Centre, 248 Queen's Road East, Wanchai

IE image5vqz.png

Arjo Ireland Ltd

A House Damastown Industrial Park,

Mulhuddart. Dublin 15 , D15 XWR3

+353 1 809 8960

DPC

+353 76 110 4800

info@dataprotection.ie

21 Fitzwilliam Square

D02 RD28 Dublin 2

IN imaged35c.png

Arjo Healthcare India Pve Ltd.

Plot No. 8 Shah Industrial Estate, Off Veera Desai Road, Andheri (West), IN-400053 Mumbai

+91 22 6694 6697

CERT-In

+91-11-2439-8572

csk@cert-in.org.in

Ministry of Electronics and Information Technology, Government of India, Electronics Niketan, 6, CGO Complex, Lodhi Road, New Delhi – 110 003

IT imagepkjv8.png

Arjo Italia SpA

402, Via Giacomo Peroni, 400, 00131 Roma RM

+39 06 8742 6211

Garante

+39 06 69 677 1

segreteria.stanzione@gpdp.it

Piazza Venezia, 11

00187 Roma

JP imagel8nwa.png

Arjo Japan K.K.

9th Floor, Landic Toranomon 2nd Building, 3-7-8 Toranomon, Minato-ku, Tokyo, 105-0001

+81 03-6435-6401

PIPC

+81 3-6457-9680

Online form

1-2, Kasumigaseki 2-chome, Chiyoda-City, Tokyo, 100-8926

KR imagehaln.png

Arjo Korea

2213, 22F, Seoul City Tower 110, 04637, Huam ro, Jung-Gu, Seoul

+82 02-567-6502-3

KISA

+82 2 405 6484

webmaster@kisa.or.kr

IT Venture Tower, 135 Jungdae-ro, Songpa-gu, Seoul, 05717

MX imagektwc7.png

Arjo Brazil

Rua Marina Ciufuli Zanfelice, 329 - Prédio 2 Lateral - Lapa, São Paulo - 05040-000, SP

+55 11 3588-5088

INAI

+52 800 835 43 24

atencion@inai.org.mx

Insurgentes Sur No. 3211 Col. Insurgentes Cuicuilco, Alcaldía Coyoacán, 04530, CP

NL imageztb8b.png

Arjo Nederland BV

PO Box 6116, Bezoekadres: Biezenwei 21, 4004 MB – Tiel

+31 344 640 800

AP

+31 70 888 8500

Online form

Bezuidenhoutseweg 30, P.O. Box 93374, 2509 AJ Den Haag

NO imageg4czb.png

Arjo Norge AS

Nils Hansens vei 8

0667 Oslo

+47 22 08 00 50

Datatilsynet

+47 22 39 69 00

postkasse@datatilsynet.no

Tollbugata 3, 0152 Oslo

NZ imageuicj7.png

Arjo New Zealand Limited

34 Vestey Drive, Mount Wellington, Auckland 1060

+64 (0)9 573 5344

Privacy Commissioner

+64 (0)800 803 909

Online form

PO Box 10 094, Wellington 6143

PL image8lrpr.png

ArjoHuntleigh Polska Sp. z o.o.

ul. Salsy 2

02-823 Warszawa

+48 691 36 56 30

UODO

+48 22 531 03 00

kancelaria@uodo.gov.pl

ul. Stawki 2, 00-193 Warszawa

PT image4vseo.png

Arjo Ibérica S.L.

Poligono Can Salvatella

c/ Cabanyes 1-7 08210 Barberà del Valles, Barcelona, Espana

+34 900 921 850

CNPD

+ 351) 213 928 400

geral@cnpd.pt

Av. Dom Carlos i 134 - 1 º, 1200-651 Lisboa

RU imagebqwm8.png

Arjo Huntleigh International Limited

40 Prospect Mira, 8th floor, 822 office, Moscow, 129090

+7 495 139 36 01

ICO

+44 (0)303 123 1113

Online form

Wycliffe House

Water Lane, Wilmslow Cheshire, SK9 5AF, United Kingdom

SE image1u6.png

Arjo Sverige AB

Box 48, Hans Michelsensgatan 10, 201 20 Malmö

+46 10 335 4500

IMY

+46 8 657 6100

imy@imy.se

Drottninggatan 29

5th Floor, Box 8114

104 20 Stockholm

SG imageveat.png

Arjo South East Asia Pte Ltd

31 Kaki Bukit Road 3, Techlink, Lobby B, Singapore 417818

+65 6202 7366

PDPC

+65 6377 3131

Online form

10 Pasir Panjang Road, #03-01 Mapletree Business City 117438

UK imagedfcr7.png

Arjo UK Limited

Houghton Hall Business Park,

Houghton Regis, Bedfordshire, LU5 5XF

+44 (0) 1582 745 700

ICO

+44 (0)303 123 1113

Online form

Wycliffe House

Water Lane, Wilmslow Cheshire, SK9 5AF

US imagevxyyc.png

Arjo Inc.

2349, West Lake Street - Suite 250, Addison, US-IL, 60101

+1 (800) 323 1245

Secretary of HHS – OCR

+1 800-368-1019

N/A

200 Independence Avenue, S.W. Washington, D.C. 20201

US image9cacd.png (California)

Arjo Inc.

2349, West Lake Street - Suite 250, Addison, UIL, 60101

+1 (800) 323 1245

Attorney General’s Office

+1 916-210-6276

N/A

P.O. Box 944255, Sacramento, CA 94244-2550

US image18vxo5.png (Illinois)

Arjo Inc.

2349, West Lake Street - Suite 250, Addison, US-IL, 60101

+1 (800) 323 1245

Attorney General’s Office

+1 800-243-0618

datasecurity@ilag.gov

Constituent Services

100 West Randolph Street, Chicago, Illinois 60601

ZA imagelln2q.png

Arjo Huntleigh South Africa (Pty) Ltd

2 Willem Cruywagen Avenue Klerksoord, Akasia, 0182

+27 12 527 2000

Information Regulator

+27 10 023 5200

enquiries@inforegulator.org.za

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001