ICA collects personal data that you provide yourself, such as when you communicate with us.

ICA collects personal data from the company you work for, e.g. in connection to a procurement or when buying goods or services.

We cooperate often with other ICA companies and therefore collect your personal data from them, e.g. in connection to a procurement or when buying goods or services.

ICA collects personal data that other persons provide to us, e.g. in order to get in contact with your company.

In certain cases, ICA collects information that is generally available, such as on social media to get in contact with your company in relation to a procurement or to manage the vendor relationship.

In relation to a procurement of a new vendor, ICA process your personal data, e.g. in order to collect contact details about you as a contact person for the vendor prior to a procurement, to collect information during a procurement or to finalize a procurement.

Categories of personal data
• Identity information
• Contact information
• Competence information
• Organisational information

Legal basis
Legitimate interest. The processing is necessary to meet our legitimate interest in procuring vendors.

Storage period
During the procurement and for 10 years thereafter.

ICA process your personal data in order to manage the vendor relationship, e.g. to register your contact details in the ICA companies vendor register, mange vendor declarations, administer vendor invoices and to manage and archive vendor agreements.

Categories of personal data
• Identity information
• Contact information
• Organisational information

Legal basis
Legitimate interest. The processing is necessary to meet our legitimate interest in managing the vendor relationship.

Storage period
During the relationship and for 10 years thereafter. Bookkeeping materials are stored for 7 years.

ICA process, to the extent necessary, your personal data to evaluate and follow up on the vendor relationship.

Categories of personal data
• Identity information
• Organisational information

Legal basis
Legitimate interest. The processing is necessary to meet our legitimate interest in evaluating and following up on vendor relationships.

Storage period
Reports on an overall level which does not contain any personal data are stored until further notice.

ICA processes your personal data, if necessary, to manage and meet legal requirements, such as in a dispute or legal process.

Categories of personal data
All data that is collected and that is necessary to manage and meet the legal requirement in question.

Legal basis
Legitimate interest. The processing is necessary to meet our legitimate interest in managing and meeting legal requirements.

The processing of personal identity numbers is necessary in view of the purpose of the processing.

We process special categories of personal data, such as health information, if it is necessary to manage and meet legal requirements.

Any processing of data about legal violations that entail a crime is done only if the processing is necessary to be able to determine a legal claim, cite a legal claim or defend a legal claim in an individual case.

Storage period
Your personal data is stored for the period that is necessary for this purpose.

The personal data above may be shared with external advisers and courts, counterparties, etc. with the legal basis of legitimate interest.

ICA processes your personal data to meet legal obligations, such as for bookkeeping and accounting purposes.

Categories of personal data
All data that is collected and that is necessary to manage and meet the respective legal obligation.

Legal basis
To meet a legal obligation.

Storage period
Your personal data is stored for the period that is necessary in relation to the respective legal obligation.

The personal data above may be shared with authorities, external advisers and law enforcement agencies, such as the police, to manage a legal obligation.

ICA processes your personal data to manage, protect and develop our systems and services for troubleshooting, logging, developing, testing and improving our systems and services.

Categories of personal data
All data that is indicated under the respective type of processing.

Legal basis
Legitimate interest. The processing is necessary to meet our legitimate interest in managing, protecting and developing our systems and services from a lifecycle perspective. Processing of personal identity numbers is necessary in view of the purpose of the processing.

Storage period
Your personal data is stored for the same period that is indicated in relation to the respective purposes referred to above for processing of your personal data. Personal data in logs is stored for troubleshooting and incident handling for a period of 13 months counting from the date of the log event.

ICA processes your personal data in connection with communication with you, between employees and with other external persons in the course of their work.

Categories of personal data
• Identity information
• Communication
• Contact information
• Organisational information

Legal basis
Legitimate interest. The processing is necessary to meet our legitimate interest in enabling communication between employees and with external persons in the course of their work.

Storage period
Your personal data is stored for this purpose for a maximum period of twenty-four (24) months from the date of collection.

The personal data above may be shared with participants and their companies or organisations, cooperation partners, ICA companies, ICA stores and external persons with the legal basis of a legitimate interest.