Processing of personal data

Ahlsell values your privacy and therefore wants you to easily find information about how we process your personal data. Therefore, we have divided the information based on your relationship with us.

Select the link/links that are relevant for you to read about how we process your personal data:

You are a customer of ours/we see you as a potential customer »

You have visited us physically or digitally »

You are our supplier, business- or collaboration partner »

Your rights

The information below about your rights applies regardless of your relationship with us. When you request to exercise your rights, you may need to verify your identity. When we receive a request, we will get back to you within one (1) month of receiving your request. If we need more time to process your request, we will inform you accordingly.

1.1 Right of access (register extract)

You have the right to know if we process personal data about you. If we do, you also have the right to obtain information about what personal data we process and how we process it. Furthermore, you also have the right to obtain a copy of the personal data we process about you. If you are interested in specific information, please indicate such in your request.

1.2 Right to rectification

If any of the personal data we process about you is incorrect, you have the right to have it corrected. You also have the right to update incomplete personal data with additional information necessary to make the data complete. Once we have corrected your personal data or updated it with new information, we will inform those to whom we have disclosed your data to, i.e., provide them with information on the updates, if it isn’t impossible or too burdensome. If you request it, we will also tell you who we have disclosed your data to. If you request rectification, you also have the right to request that we restrict our processing of your data while we manage your request.

1.3 Right to erasure (right to be forgotten)

• The data no longer is needed for the purposes for which it was collected or otherwise processed.
• You object to the processing of the data based on our legitimate interest and we cannot prove that our reasons for processing outweigh your interests.
• The personal data is processed unlawfully.
• We have a legal obligation to delete your personal data.

If we delete your data after you have requested such action, we will also inform those to whom we have disclosed the data to about the deletion. This is if it isn’t impossible or too burdensome. If you ask us, we will inform you about whom we have disclosed your data to.

1.4 Right to restriction

• When you believe that the data is incorrect and you have requested correction. In such case, you can also request that the processing is to be restricted while we investigate whether the data is correct or not.
• If the processing is unlawful and you don’t want the data to be deleted.
• When we no longer need to process the data for the purposes for which we collected it, but you need it to establish, assert or defend legal claims.
• If you have objected to the processing based on our legitimate interest. In this case, you may request that we restrict the processing while investigating whether our interest in processing your data outweighs your
• interests.

1.5 Right to object

You have the right to object to our processing of your personal data based on our legitimate interest. If you object to the processing, we will, based on the specific situation in relation to you, assess whether our interest/interests in processing the data outweighs your interests in the data not being processed. If we cannot demonstrate compelling legitimate grounds that outweigh yours, we will terminate the processing to which you object. This is if we don’t have to process the data to establish, exercise or defend legal claims.

1.6 Right to data portability

Data portability means that you have the right to obtain the data we have collected from you about you in a structured, commonly used and machine-readable format, and that you have the right to transfer such to another data controller.

• To data that has been collected from you about you,
• If the use is for the purpose of fulfilling an agreement with you, and
• The processing is automated.

1.7 Right to complain

Please contact us if you are dissatisfied with how we process your personal data. You also have the right to submit a complaint to the applicable supervisory authority. The Swedish Data Protection Authority (IMY) is the Swedish supervisory authority for our processing of your personal data. You also have the right to file a complaint with the supervisory authority in the country where you live or work. Alternatively, in the country where you believe a violation of the regulations has taken place.

1.8 Right to withdraw consent

You have the right to withdraw your consent to a specific type of processing at any time. This doesn’t affect the lawfulness of processing before consent was withdrawn. Please contact us using the contact details below if you wish to withdraw your consent. You can also withdraw your consent to usage of cookies and other tracking techniques directly in our cookie banner.

Contact

Ahlsell Sverige AB, organizational No.: 556012-9206, (“Ahlsell”, “we”, “us”, “our”) is the data controller for the personal data processing described in this information. If you have any questions about our processing of personal data or wish to exercise any of your rights, please contact us.

Ahlsell Sverige AB
Årstaängsvägen 11,
117 60 Stockholm, Sweden
+46 (0) 8-685 70 00 (ask for CISO/DPM)
datarequest@ahlsell.se

Sharing of your personal data

To maintain our relationship and comply with laws and regulations, we sometimes need to share your personal data with others. Below you will find information about who we share your personal data with, when applicable.

Suppliers, partners and Group-companies

• IT suppliers: companies that provide IT-products/services, such as IT-systems and IT- services, including managing the operation, technical support and maintenance of such.
• Suppliers and partners: other suppliers of products/services/IT-systems/IT-services and partners who may process your personal data for us to fulfil our commitments to you and our legal obligations.
• Group-companies: companies belonging to the Ahlsell-Group that have access to our IT-systems/IT-services and internal portals, as well as for other internal Group purposes.

When our suppliers, partners and Group-companies process personal data on our behalf, they act as our Data Processors and aren’t permitted to use your personal data for their own purposes. In addition, they are required by law and by agreement with us to protect your data.

Other/external companies and third parties

• Government authorities: for example, the Police Authority, IMY, the Tax Authority, and other authorities when required by law or in the event of supervision/suspicion of crime/violation.
• Courts or arbitration board: in the event of a dispute or other legal pro.
• Other third parties: for example, insurance companies, legal and financial advisers, banks and auditors. Your personal data may also be disclosed to potential buyers and sellers and their advisors if this is necessary to carry out a restructuring, merger, acquisition or divestment/sales of all or part of our assets (if applicable).

When our personal data processing takes place outside the EU/EEA

We always strive to process your personal data within the EU/EEA, but in certain situations we may need to transfer your personal data to other Ahlsell-companies and partners or service providers located outside the EU/EEA (so-called third countries).

Regardless of where your personal data is processed, we take all reasonable contractual, technical and organizational security measures to ensure that the level of protection for the processing is equivalent to that applicable within the EU/EEA. For transfers to recipients in the United Kingdom, Israel, Japan and Canada, adequacy decisions by the European Commission apply (which you can find here (Article 45 of the GDPR)). The same applies to transfers to recipients in the United States when the recipients have joined the EU-US Data Privacy Framework (which you can find here (Article 45 of the GDPR)).

For recipients in other countries outside the EU/EEA, we enter into the European Commission's standard contractual clauses, which you can find here (Article 46.2 c of the GDPR). We also take additional technical and organizational protective measures, when necessary, such as encryption and pseudonymization.

Source of personal data

We mainly collect your personal data directly from you. In some cases, we may also collect data from publicly available sources or registers, for example, from authorities in Sweden and equivalent authorities abroad, databases containing personal information, or through our own internal processes, such as our IT-infrastructure, when entering and leaving premises, and through camera surveillance (CCTV).

Opting out of personal data processing

When we process your personal data, we do so, among other things, for the purpose of complying with statutory or contractual requirements. If you don’t provide the personal data we request, this may imply that we cannot enter into an agreement or fulfil our obligations under the agreement or under the applicable law.

Changes to this information

This information may be updated on an ongoing basis.

The information was last updated on 2026-02-20.