IKEA Älmhult AB Privacy Statement for Suppliers

Management of job and internship candidates (including management of related database);

Undertaking recruitment processes (including assessment of candidates, background checks including fitness for work (where necessary only), and communicating with candidates);

Acquiring and providing job references.

When required, behavioural assessment of candidates (Predictive Index) to determine the suitability for a position that an applicant has applied for.

To produce all the documentation needed to hire a candidate (employment agreement, visa requirements, etc).

Information provided during the recruitment process: personal data contained in CV, resumes and application form, references, record of interview or interview notes, and selection and verification records and previous (job) experience.

Basic work details: work contact details (corporate email address and telephone number), employee identification number, user ID, photograph, details regarding the job function, primary work location, working hours, annual leave and family related leave records, emergency contacts, retirement eligibility, employment status, and terms and conditions of employment.

Legitimate interest (Article 6.1 (f) GDPR).

The processing is necessary for purposes of our legitimate interest to be able to recruit and find the suitable candidate to work at IKEA.

Performance of a contract (Article 6.1 (b) GDPR)

The processing is necessary to take steps at the request of the data subject prior to entering an employment contract.

Storage period: One (5) years counted from the moment of closure of the recruitment process.

Management and maintenance of physical site safety and security (including to manage physical access and administer camera surveillance).

Video surveillance footage and physical access records (recorded in and on premises of the Inter IKEA Group by the use of video surveillance equipment (CCTV) or access logging systems).

Legitimate interest (Article 6.1 (f) GDPR).

The processing is necessary for purposes of our legitimate interest to be able to detect misconduct and protect IKEA’s asset in their different form.

Management and maintenance of IT systems, network and office equipment including cybersecurity risk management, internal audits, data loss prevention, security assessments, logging and managing access rights and related requests.

Monitoring the use of the IT systems for compliance with applicable policies.

All categories and types of personal processed on the IT Network including information for use of company network and devices (information that is required to access company systems and applications such as email account and system passwords, in some cases also device information of devices provided such as mobile phones or laptops).

Legitimate interest (Article 6.1 (f) GDPR).

The processing is necessary for purposes of our legitimate interest to be able to prevent, detect, identify and resolve security threats to IKEA assets in their different forms.

Other forms of risk management, including fraud prevention and investigation.

Internal investigations such as enquiries into ethics & integrity or breaches of codes of conduct (including legal hold and data access processes) where necessary and in accordance with local legal requirements.

Personal identification information (e.g., name, address, contact details).

Employment-related information (e.g., job title, department, employment history).

Allegations or reports of misconduct or breaches of codes of conduct.

Witness statements or testimonies.

Communications related to the investigation (e.g., emails, chat logs, systems logs).

Any other relevant personal data necessary for conducting the investigation and ensuring compliance with legal requirements.

Compliance with a legal obligation. (Article 6.1 (c) GDPR).

The processing is necessary for the purpose of compliance with a legal obligation of providing tight security assurances, healthy work environment, compliance with financial and other applicable legislation.

Legitimate interest (Article 6.1 (f) GDPR).

The processing is necessary for purposes of our legitimate interest to be able to detect misconduct and run out business in a legal and ethical way.

For management of sanctioned party screening

Corporate email-address of the contact person of the party

Financial information (e.g., bank account details, transaction history)

Sanction-related information (e.g., presence on sanction lists, reasons for listing)

Any other relevant personal data necessary for conducting the screening process and complying with legal requirements related to sanctions.

Compliance with a legal obligation. (Article 6.1 (c) GDPR).

The processing is necessary for the purpose of compliance with a legal obligation by which certain screenings are legally mandatory. 

Legitimate interest (Article 6.1 (f) GDPR).

The processing is necessary for purposes of our legitimate interest to be able to detect misconduct.

To identify you as the business partner in marketing or communication material at all IKEA customer meeting points throughout the world next to one or more of the products you have designed IKEA as a brand whenever applicable – together with corresponding information material of any other business partner.

Your name, professional details including your CV, other work details when relevant, such as what team you might be a part of in your organization, as well as your picture, voice, and comments you may have supplied us with regarding our or your business.

Performance of a contract (Article 6.1 (b) GDPR)

The processing is necessary for the performance of the agreement that you have with us as a designer, model, performer, etc.

Legitimate interest (Article 6.1 (f) GDPR).

The processing is necessary for purposes of our legitimate interest to be able to keep our products and brand relevant and up to date and inform our customers about the identity of the people and organizations who support us in our development process.

For internal communication across IKEA as well as with IKEA affiliates and business partners.

Your name and picture, your voice, information about your preferences and opinions, quotes, interviews, results from surveys that you may have participated in, comments you may have supplied us with regarding our or your business, as well as documents and works (in any format, such as video or sound recordings) that you might create and voluntarily share with us.

Performance of a contract (Article 6.1 (b) GDPR)

The processing is necessary for the performance of the agreement that you have with us as a designer, model, performer, etc.

Legitimate interest (Article 6.1 (f) GDPR).

The processing is necessary for purposes of our legitimate interest to be able to keep our internal communication flowing and up to date and inform our co-workers and business partners about multiple aspects of our brand, customers, business partners, etc.

For external communication by global and local publishing of different content in different media channels including but not limited to publications online, social media, earned media, printed media, paid media.

Your name, picture, and voice, along with information about your preferences and opinions, quotes, interviews, and results from surveys that you may have participated in. In addition to this, comments that you may have supplied us with regarding our or your business may be collected as well as documents and works (in any format, such as video or sound recordings) that you might create and voluntarily share with us.

Performance of a contract (Article 6.1 (b) GDPR)

The processing is necessary for the performance of the agreement that you have with us to participate on different events or campaigns.

Legitimate interest (Article 6.1 (f) GDPR).

The processing is necessary for purposes of our legitimate interest to be able to keep expanding the IKEA brand.

Storage period: We will store this information for as long as the life validity of the IP rights supporting the works. You have the right to object to the processing as explained in your rights section of this privacy statement.

Managing our general business operations; facilitating business operations and corporate transactions.

Managing and fulfilling internal financial reporting and auditing, recordkeeping, and other related purposes.

Contact details (such as name, email address, address, phone number).

Data required as part of due diligence (e.g., professional qualification, location, ITAR approval, citizenship etc.).

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and IKEA.

Personal data related to audit records and trails.

Company details including business name, role, and business address.

Performance of a contract (Article 6.1 (b) GDPR)

The processing is necessary for the performance of the agreement that you have with us. For us to perform our obligation under the agreement, such as payment, we need to process the necessary data.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to provide correctly administer our business.

Complying with applicable law and legal obligations, such as tax law, labor law, corporate governance including financial reporting and forecasting.

Complying with legal processes such as search warrants, subpoenas or court orders.

Contact details (such as name, email address, address, phone number) of relevant data subjects.

Data required as part of due diligence (e.g., professional qualification, location, ITAR approval, citizenship etc.).

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and Inter IKEA.

Personal data related to audit records and trails.

Company details including business name, role and business address.

Compliance with a legal obligation (Article 6.1 (c) GDPR)

The processing is necessary for complying with legal obligations under applicable law.

Assist in handling payments out and approving payments and expense reimbursements, including towards suppliers and business partners.

Contact details (such as name, email address, address, phone number) of relevant data subjects.

Data required as part of due diligence (e.g., professional qualification, location, ITAR approval, citizenship etc.).

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and Inter IKEA.

Personal data related to audit records and trails.

Company details including business name, role and business address.

Performance of the contract (Article 6.1 (b) GDPR).

The processing is necessary for us to be able to process payment when you partner up with us.

You need to provide the personal data to us, otherwise, you will not be able to process your payment.

Compliance with a legal obligation (Article 6.1 (c) GDPR)

The processing is necessary for complying with legal obligations under applicable law.

Conduct business analysis, such analysis of revenue, margin fluctuations, quality monitoring.

Contact details (such as name, email address, address, phone number) of relevant data subjects.

Data required as part of due diligence (e.g., professional qualification, location, ITAR approval, citizenship etc.).

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and IKEA.

Personal data related to audit records and trails.

Company details including business name, role, and business address.

Legitimate interest (Article 6.1 (f) GDPR).

The processing is necessary for the purposes of our legitimate interest to provide correctly administer our business.

Detecting, preventing, and stopping financial fraud.

Contact details (such as name, email address, address, phone number) of relevant data subjects.

Data required as part of due diligence (e.g., professional qualification, location, ITAR approval, citizenship etc.).

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and Inter IKEA.

Personal data related to audit records and trails.

Company details including business name, role, and business address.

Compliance with a legal obligation (Article 6.1 (c) GDPR)

The processing is necessary for complying with legal obligations under applicable law.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to correctly administer our business.

As part of regular reporting activities to other members of the Inter IKEA Group.

Contact details (such as name, email address, address, phone number) of relevant data subjects.

Data required as part of due diligence (e.g., professional qualification, location, ITAR approval, citizenship etc.).

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and IKEA.

Personal data related to audit records and trails.

Company details including business name, role, and business address.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to correctly administer our business.

To protect the rights and property of the Inter IKEA Group or others.

Contact details (such as name, email address, address, phone number) of relevant data subjects.

Data required as part of due diligence (e.g., professional qualification, location, ITAR approval, citizenship etc.).

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and IKEA.

Personal data related to audit records and trails.

Company details including business name, role, and business address.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to correctly administer our business.

Storage period: Your personal data will be stored for as long as required by law. In general terms this is 10 years counted from the moment of the transaction.

Supplier/Service provider onboarding and assessment: onboarding, including financial screening, sanction party screening and general assessment of the supplier/service provider.

Contact details (such as name, email address, address, phone number).

Company details including business name, role and business address.

Key business contacts. Data required as part of supplier/service provider assessment (e.g., who the owners are, cross check against sanction lists).

Information regarding orders and other transactional details.

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and Inter IKEA.

Compliance with a legal obligation (Article 6.1 (c) GDPR)

The processing is necessary for complying with legal obligations under applicable law.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to correctly administer our business.

Database management: managing databases relationships with former, existing and prospective suppliers/service providers.

Contact details (such as name, email address, address, phone number).

Company details including business name, role and business address.

Key business contacts. Data required as part of supplier/service provider assessment (e.g., who the owners are, cross check against sanction lists).

Information regarding orders and other transactional details.

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and Inter IKEA.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to correctly administer our business.

Supplier/service provider management: conducting tender activities, requests for proposals and contract negotiation; managing relationship with existing and prospective suppliers/service providers.

Contact details (such as name, email address, address, phone number).

Company details including business name, role and business address.

Key business contacts. Data required as part of supplier/service provider assessment (e.g., who the owners are, cross check against sanction lists).

Information regarding orders and other transactional details.

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and Inter IKEA.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to correctly administer our business.

Support and communications: communicate with service providers regarding the services, including to develop and improve the quality of services; assisting in handling complaints and requests.

Contact details (such as name, email address, address, phone number).

Company details including business name, role and business address.

Key business contacts. Data required as part of supplier/service provider assessment (e.g., who the owners are, cross check against sanction lists).

Information regarding orders and other transactional details.

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and Inter IKEA.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to correctly administer our business.

Supplier/service provider contracting: administration and execution of the agreements concluded with suppliers/service providers.

Contact details (such as name, email address, address, phone number).

Company details including business name, role and business address.

Key business contacts. Data required as part of supplier/service provider assessment (e.g., who the owners are, cross check against sanction lists).

Information regarding orders and other transactional details.

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and Inter IKEA.

Performance of the contract (Article 6.1 (b) GDPR)

The processing is necessary for us to be able to comply with your payment when you partner up with us.

You need to provide the personal data to us, otherwise, you will not be able to process your payment.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to correctly administer our business.

Accounting and finance: facilitate invoicing, billing, collections and related activities.

Contact details (such as name, email address, address, phone number).

Company details including business name, role and business address.

Key business contacts. Data required as part of supplier/service provider assessment (e.g., who the owners are, cross check against sanction lists).

Information regarding orders and other transactional details.

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and Inter IKEA.

Compliance with a legal obligation (Article 6.1 (c) GDPR)

The processing is necessary for complying with legal obligations under applicable law.

Performance of the contract (Article 6.1 (b) GDPR)

The processing is necessary for us to be able to comply with your payment when you partner up with us.

You need to provide the personal data to us, otherwise, you will not be able to process your payment

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to correctly administer our business.

Audits and assessments: conducting audits and assessments of suppliers/service providers (including security audits).

Contact details (such as name, email address, address, phone number).

Company details including business name, role and business address.

Key business contacts. Data required as part of supplier/service provider assessment (e.g., who the owners are, cross check against sanction lists).

Information regarding orders and other transactional details.

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and Inter IKEA.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to correctly administer our business.

Recordkeeping: fulfilling management and recordkeeping purposes

Contact details (such as name, email address, address, phone number).

Company details including business name, role and business address.

Key business contacts. Data required as part of supplier/service provider assessment (e.g., who the owners are, cross check against sanction lists).

Information regarding orders and other transactional details.

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and Inter IKEA.

Compliance with a legal obligation (Article 6.1 (c) GDPR)

The processing is necessary for complying with legal obligations under applicable law such as corporate law, tax law, international trade legislation, import and export legislative frameworks.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to correctly administer our business.

Dispute resolution and management: manage and address disputes with suppliers/service providers.

Contact details (such as name, email address, address, phone number).

Company details including business name, role and business address.

Key business contacts. Data required as part of supplier/service provider assessment (e.g., who the owners are, cross check against sanction lists).

Information regarding orders and other transactional details.

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and Inter IKEA.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to correctly administer our business.

Performance of the contract (Article 6.1 (b) GDPR)

The processing is necessary for us to be able to comply with contractual obligations assumed by us when you partner up with us.

You need to provide the personal data to us, otherwise, you will not be able to process your payment.

To identify you in marketing or communication material throughout the world next to one or more of the products designed for IKEA of Sweden AB and – whenever applicable – together with corresponding information material of any other business partner.

Your name, professional details including your CV, other work details when relevant, such as what team you might be a part of in your organization, as well as your picture, voice, and comments you may have supplied us with regarding our or your business.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to correctly administer our business.

Performance of the contract (Article 6.1 (b) GDPR)

The processing is necessary for us to be able to comply with your or ours obligations under the agreement that you have signed with us e.g..

You need to provide the personal data to us, otherwise, you will not be able to process your payment.

Storage period: Your personal data for 10 years.

Collaboration and Communication: provision of global email, calendar sharing, communication, messaging, document sharing, shared workspaces, and other online collaboration services and tools, including:

To facilitate access to collaboration, communications, and company knowledge management tools and assets.

To enable communications.

To establish corporate directory.

Calendar integration and Outlook-related integrations to enable communication, availability and scheduling.

Cross-organization access to document sharing platforms and shared workspaces, as well as other cross-company systems and data, on a need-to-know basis.

Network support and IT services related to such tools.

Administration, security and management: management and security associated with collaboration and communications resources, including data loss prevention.

Company and user information, including:

Name

Business email, phone number, address and contact info

Computer name

Title

Location

Direct report/manager, department, and cost centre

Calendar visibility, such as free/busy status

Support and service tickets and requests related to tools and resources.

Other network and organizational information necessary to provision, secure and maintain access to resources and tools, including:

IP address, device and user IDs/names

Event logs and other log files

Roles

Email and attachments, file and folder content, hashes, history, and associated metadata.

Domain names, and URLs.

Configuration information such as for example software version information, applied patches, security settings, permissions, or other technical settings for laptops, desktops and other endpoints.

Utilization statistics.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to provide customer service, i.e. support.

Storage period: We will store this information for as long as the life validity of the IP rights supporting the works. You have the right to object to the processing as explained in your rights section of this privacy statement.

Collect information that is necessary in order to improve the System and different functionalities.

We will collect information about you to acknowledge patterns in how our Systems and the different functions are used. To best ensure your privacy while doing so, we only process personal data on an aggregate level.

• IP-address.

• Geographical location (only on an aggregate level and not exact address).

• Information regarding how you use the System, e.g. what features you enable in the System as well as your use of the features (e.g. if you turn on a connected lamp).

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to provide better tools to our co-workers and suppliers.

Collect information that is necessary in order to improve the Application and different functionalities. To do this we use the analytic service from Google (i.e. Google Firebase Analytics including Google Analytics). You can find more information on how Google processes your personal data on Google’s website.

This analytics service from Google will collect information about you to acknowledge patterns in how the Application and the different functions are used. To best ensure your privacy while doing so, we only process personal data on an aggregate level.

• IP-address.

• Geographical location (only on an aggregate level and not exact address).

• Information regarding how you use the Application, e.g. what features you enable in the System as well as your use of the features (e.g. if you turn on a connected lamp) and what you click on in the Application.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for the purposes of our legitimate interest to provide better tools to our co-workers and suppliers.

Storage period: We will store your personal data for as long as necessary to perform our analysis and further improve the System and the Application and no longer than one (1) year.

Google will continue to store your personal data for its own purposes and Google will inform you separately about such storing.

For product research and development

Personal identification information (e.g., name, address, contact details).

• Family relation.

• Opinions, preferences, interests, designs.

• Images in different formats.

• Voice.

• Home or workshop interior.

Performance of the contract (Article 6.1 (b) GDPR)

The processing is necessary for us to be able to comply with your payment when you partner up with us.

You need to provide the personal data to us, otherwise, you will not be able to process your payment.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for purposes of our legitimate interest to be able to keep our products and brand relevant and up to date.

Storage period: We will store your personal data for as long as necessary to perform our product development and further improve our products.

To keep and manage records on the IKEA Archive.

 Your name, professional details including your CV, other work details when relevant, such as what team you might be a part of in your organization, as well as your picture, voice, and comments you may have supplied us with regarding our or your business.

Your name, picture, and voice, along with information about your preferences and opinions, quotes, interviews, and results from surveys that you may have participated in. In addition to this, comments that you may have supplied us with regarding our or your business may be collected as well as documents and works (in any format, such as video or sound recordings) that you might create and voluntarily share with us.

Company details including business name, role and business address.

Information regarding orders and other transactional details.

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and Inter IKEA.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for purposes of our legitimate interest to be able to keep our products and brand relevant and up to date.

Storage period: We will store your personal data for as long as it is relevant for our archives.

Production of cultural exhibitions at the IKEA Museum.

Your name, professional details including your CV, other work details when relevant, such as what team you might be a part of in your organization, as well as your picture, voice, and comments you may have supplied us with regarding our or your business.

Your name, picture, and voice, along with information about your preferences and opinions, quotes, interviews, and results from surveys that you may have participated in. In addition to this, comments that you may have supplied us with regarding our or your business may be collected as well as documents and works (in any format, such as video or sound recordings) that you might create and voluntarily share with us.

Company details including business name, role and business address.

Information regarding orders and other transactional details.

Financial information (such as business bank account or invoicing details).

Other personal data disclosed during communications between an individual and Inter IKEA.

Performance of a contract (Article 6.1 (b) GDPR)

The processing is necessary for the performance of the agreement that you have with us to participate on different events or campaigns.

Legitimate interest (Article 6.1 (f) GDPR)

The processing is necessary for purposes of our legitimate interest to be able to keep our products and brand relevant and up to date.

Storage period: We will store your personal data for as long as it is relevant for our exhibition