Privacy statement

Here you will find our privacy statement at TRATON Financial Services AB. It provides information on how we handle your personal data. We care for transparency, why it may take a while to read it all. You are of course welcome to reach out to us if you cannot find what you are looking for. If you want to exercise your rights as a data subject, you can make your queries directly at us, at our DPO, but also at your local data protection authority.

Who are we?
This statement applies to TRATON Financial Services AB (abbreviated, TFS), incorporated in Södertälje (Sweden) 15187. You can reach out to TFS at info@tratonfs.com or at our address: Kvarnbergagatan 14a, 151 87 Södertälje

What are the contacts of the DPO?
The Data Protection Officer at TFS is in Södertälje (same as above) and can be reached at dpo@tratonfs.com

Introduction, our purposes and our values

TRATON Financial Service is a human centric organisation, where responsibility and respect are the foundation of our interactions with you in your role as our valued customer, co-worker, trusted business partner, supplier or when visiting our websites, premises or events. The data controller responsible for your personal data is TRATON Financial Services AB, unless otherwise stated in a privacy statement specific to a market or a service as accessible through our website. We process your personal data when it is needed to:

deliver our products and services and tailor them to your needs
support and assist you when you use our products and services
fulfil and follow up contractual obligations, ours as well as yours
learn about our customer’s creditworthiness and monitor our credit exposure with our clients in our markets
fulfil legal obligations and legitimate requests (regular or ad hoc) from law enforcement and other authorities, including conducting all the necessary checks to issue financial products
provide information about our products and services as well as upcoming events
improve quality and develop existing, as well as new, products and services as well as our organization

Sometimes we utilise trusted business partners to help us deliver our products and services. In cases when we need to share your personal data with our business partners, we ensure that they treat your personal data with the same responsibility and respect. In this statement we would like to inform you what personal data we process, why we are doing it and how we ensure that your rights are respected and exercised. Further information about how your personal data is processed may in specific cases be found in more detailed privacy notices and service descriptions. You will in these cases find the information when accessing the application/system/service. If you have any questions or concerns, you are always welcome to contact us or talk to your TFS contact.

What are your rights with respect to the data we process about you?

We commit to handle your data with fairness, transparency, security, and in a minimised manner. However, at any time you can request access to your data. Furthermore, upon meeting legal requirements, you may request your data to be removed, suspended from processing or moved to another company. We commit to act within 30 days from the receipt of your query.

What data about you do we process?

First, you may be interacting with us in several different capacities. You as an individual who entrusts us with the processing of your data are normally called 'data subject'. In this list you will find the following categories of data subject: customer (or prospect customer), employee, partner /supplier/consultant, visitor, internet user, member of the public. If you have a relationship with our local unit, please refer to the corresponding local privacy statement first.

You are our customer

Who processes the data (our local units or our head office?)	PURPOSE	PERSONAL DATA CATEGORIES	LEGAL GROUND	RETENTION
Local units	To create a database of prospect customers, e.g., by using data from third parties	Organizational data (such as company name, country, company address and phone number) Contact information (such as name, email, phone number, address)	legitimate interest	Until you are no longer our customer
Local units	To provide you a quotation	Organizational data (such as company name, country, company address and phone number) Contact information (such as name, email, phone number, address) If you are a sole trader, we process financial data such as credit ratings Contact preferences Purchases and transactions	legitimate interest	Within three months if you are no longer interested
Local units	to provide you with updates and requested information	Organizational data (such as company name, country, company address and phone number) Contact information (such as name, email, phone number, address)	legitimate interest and local marketing regulations	Until you are no longer our customer
Local units	To verify your creditworthiness and perform our due diligence (incl. but not limited to AML checks) in the pre-contractual phase and during the contract execution	Organizational data (such as company name, country, company address and phone number) Contact information (such as name, email, phone number, address) If you are a sole trader, we process financial data such as credit ratings, bank accounts and payments transactions and purchases shareholders, owners and ultimate beneficial owners personal identification document politically exposed person (yes/no value) adverse media and previous or pending legal civil claims or indictments	Legal obligation, legitimate interest	Within 10 years after last event
Local units	to deliver upon a contract or a tender: execute it, exercise our contractual rights (incl. collection of unpaid fees), provide contractual support and make corrective actions	ID nr of vehicle trailer, superstructure or engine If you are a sole trader, we also process financial data such as credit ratings, bank accounts and payments as well as contractual related data such as contract number, order number, invoices personal identification document	performance of a contract	within 10 years after last event
Local units and Head Office	to comply with legitimate requests by authorities and follow up on legal claims	ID nr of vehicle trailer, superstructure or engine company data Financial data such as credit ratings, bank accounts and payments as well as contractual related data such as contract number, order number, invoices	legal obligation and legitimate interest	within 10 years after last event
Local units	to inform you about updates you may be interested in and follow up on our performance and your level of satisfaction of our services	Contact information (such as name, email, phone number, address) Profession Purchases	legitimate interest	Until you are no longer our customer
Head Office	to evaluate business performance of our subsidiaries, assess credit risk on a cross border level or deliberate on significant credit exposure (including evaluating our credit exposure and approve your credit application)	customer name registration numbers System logs from our IT-systems Organizational data (such as company name, country, company address and phone number) Contact information (such as name, email, phone number, address) If you are a sole trader, we process financial data such as credit ratings, bank accounts and payments transactions and purchases shareholders, owners and ultimate beneficial owners	legitimate interest	Until you are no longer our customer
Local units and Head Office	To analyse, improve quality and develop products, services and our organization	Contact information (such as name, email, phone number, address) assigned registration numbers Delivery address Purchases and transactions Financial data such as credit ratings, bank accounts and payments as well as contractual related data such as contract number, order number, invoices Responses to survey questions	legitimate interest	Until you are no longer our customer
Local units and Head Office	to execute regulatory reporting of various nature to central banks, national supervisory bodies and regulators. Head office is only involved when providing IT analytical support	Organizational data (such as company name, country, company address and phone number) Contact information (such as name, email, phone number, address) If you are a sole trader, we process financial data such as credit ratings, bank accounts and payments transactions and purchases shareholders, owners and ultimate beneficial owners personal identification document (e.g., passport)	legal obligation	Until we are no longer requested to fulfil reporting legal requirements
Local units and Head Office	to execute internal reporting	Organizational data (such as company name, country, company address and phone number) Contact information (such as name, email, phone number, address)	legal obligation and legitimate interest
Head Office	to ensure the seamless performance of our subsidiaries' loan and leasing IT system, which includes activities such as addressing tickets and maintaining service governance or data platform services	customer name assigned registration numbers System logs from our IT-systems Organizational data (such as company name, country, company address and phone number) Contact information (such as name, email, phone number, address) If you are a sole trader, we process financial data such as credit ratings Contact preferences Purchases and transactions	legitimate interest	based on local regulatory retention period. These data are collected by our subsidiaries locally and at times incidentally processed by us. We remove the data immediately after the support service has been performed

You are a TFS employee

As an employer, TFS will process personal data of people we want to attract applicants, employees, consultants and former employees. When you apply for a position at TFS, we ask you to provide some personal data in order to process your application and, if employed, prepare your employment agreement. At times, we also arrange or facilitate moving operations within mobility of employees. During your employment at TFS we process your personal data in order to:

administer your employment,
fulfil our legal obligations as an employer
fulfil our legitimate interest to e.g.:
- steer, plan and evaluate the work
- protect company employees and assets
- contact and inform employees
- being transparent to owners and the public

After you have left the company, we process limited amounts of personal data required to fulfil our legal obligations, for example personal data showing your employment period.

Who processes the data (our local units or our head office?)	PURPOSE	PERSONAL DATA CATEGORIES	LEGAL GROUND	RETENTION
Head Office and Local units	Employer branding	Contact information (such as name, e-mail address, phone number) Prior relation to TFS (such as summer job, internship, previous employments) Educational data (such as education, name of school/university) Employment data for internship (such as start/end date, shoe and clothing size, contract type, blue/white collar, salary, employment number, department, manager) Allergies Survey data (such as educational degree, job position, age, gender, interests, name, e-mail address)	Consent or legitimate interest (and local marketing law)	End of event. Personal data needed for contact for further invitations or surveys will be saved for a maximum of 4 years
Head Office and local units	Recruiting	Contact information (such as name, e-mail address, phone number, home address) Educational data (such as education, name of school or university, grades) Competences, experiences and skills (such as profession and professional history, references and recommendations, performance test) Background check (the data is collected about the final candidate for a specific position)	performance of a contract or legal obligation	based on local labour law regulation. Personal data needed for creation of employment contract is saved until end of employment.
Head Office and local units	staff and salary administration	Contact information (such as name, email, phone number, address) Employment data (such as employment number, User-ID, Photos) Financial information (such as salary, taxes, expenses, time reports etc) Leaves and working hours (such as vacation, overtime, shift hours, sick leave, offer of advance holiday, holiday rights)	performance of a contract or legal obligation	based on local labour law regulation.
Head office and local units	Travel management	Contact information (such as name, e-mail address, phone number) Employment data (such as employment number) Personal identification number Organisation information (such as department, cost centre etc) Personal Identification number Language Nationality Allergies Travel information (such as start and destination)	legitimate interest	until the expense has been reimbursed and for as long needed to fulfil national legislation.
Head office and local units	Fulfil legal obligations (e.g., reporting to authorities, whistleblowing), to comply with collective agreement (e.g., pay agreed insurance and pensions) and to answer requests from institutions such as banks and insurance companies.	Contact information (such as name, email, phone number, address) Employment data (such as start and end date, company) Citizenship Date of birth License registration Financial information (such as salary, taxes, expenses, time reports, bank account number etc) Working hours and leaves Union membership (to fulfil the collective agreement, the data is collected as needed) Access logs from IT-systems and entry systems, IT-logs from applications and network services, Camera surveillance and images	legal obligation or legitimate interest	for as long needed to fulfil national legislation.
Head Office and local units	Work environment (e.g., conducting statutory medical examinations, documenting incidents and occurrences, documenting work environment) and rehabilitation	Contact and employment data (such as name, contact information, employment number) Organisational data (such as department, name and contact information of manager) Health data (such as data on exposure to dangerous substances, health status and prognosis for health status) Incidents and occurrence data (such as where, when, description and consequence of occurrence, Rehabilitation data (such as measures for return to work and performance evaluations)	legal obligation or legitimate interest	for as long needed to fulfil national legislation.
Head Office and local units	Planning and following up (e.g., Workforce planning, Competence inventory, Succession planning, consultant follow-up) and creating statistics and analyses to improve and develop the organisation, processes and IT-systems	Contact information (such as name, email, phone number) Employment data (such as employment number, employment period, start and end date) Organizational information (place of work, cost centre, direct manager etc) Performance evaluations Educational and competence information (such as educations, trainings, professional experiences, skillsets) Performance and behaviour data Leaves and working hours (such as vacation, parental leave, shifts, overtime) Personal data in systems to be updated, improved or exchanged	legal obligation or legitimate interest	until end of employment and for additional maximum of 10 years. Personal data needed to be saved due to national legislation is saved for as long as needed due to the legislation
Head Office and local units	Learning and development (e.g., Competence development, P&D, Cross Talent, Education and Trainings)	Employment data (such as employment number, history at TFS) Contact information (such as name, e-mail address, phone number) Educational and competence information (such as educations, trainings, skill sets) Professional experiences Performance data Development plans	legal obligation or legitimate interest	Personal data on education and trainings are saved until end of employment. Personal data on performance and development is saved for a maximum of 3 years.
Head Office and local units	Expatriation	Contact information (such as name, e-mail address, phone number, address) Citizenship Date of birth Employment data (such as start and end dates of position) Organizational information (such as home and host organisation, name of manger, cost centre) Financial information (such as salary, taxes, expenses, time reports, bank account number etc) Competences and professional experiences Family data (such as family members and their citizenship, data of birth)	performance of a contract	10 years after termination of assignment
Head Office and local units	access to our IT- systems and to update, improve and/or exchange our systems	Contact information (such as name, e-mail address, phone number, address) Employment data (such as employment number, User-ID) User preference settings in systems Logs of your usage of our systems	legitimate interest	Personal data is saved until end of employment.
Head Office and local units	Safety in case of emergency	Contact information (such as name, e-mail address, phone number, address) Employment data (such as employment number) Organizational data (such as name of manager, department, place of work) Name and contact information of emergency contact Citizenship Date of birth	legitimate interest	Personal data is saved until end of employment.
Head Office and local units	To protect our employees and our company assets	Contact information (such as name, email, phone number, address) Employment data (such as employment number, User-ID, Photos) Access logs from IT-systems and entry systems, IT-logs from applications and network services, Camera surveillance Security incident reports Misconduct incident reports	legitimate interest	maximum of 2 years. Personal data from surveillance cameras is saved for a maximum of 30 days.
Head Office and local units	identify you as a TFS employee and to enable you to perform your work duties	Contact information (such as name, e-mail address, phone number, address) Employment data (such as employment number, User-ID) License registration Personal data on contracts Images, film and audio	legitimate interest	until end of employment.
Head Office and local units	To analyse, improve and develop existing and new products and services, provide you with requested information and relevant updates	Contact information (such as name, e-mail address, phone number, address) Employment data (such as employment number, User-ID) Citizenship Date of birth License registration Organizational information (place of work, cost centre, direct manager etc) Access logs from IT-systems and entry systems, IT-logs from applications and network services	legitimate interest	until end of employment.
Head Office and local units	comply with licences of open-source programs	Contributors’ contact information (such as name, email, phone number, address)	performance of a contract	until termination of contract
Head Office and local units	perform holding activities within and for the TRATON Group (Accounting, Business Development, CEO Office maintenance, Audit, Security, Investor Relations, Tax and Treasury)	professional and personal contacts (names, emails, addresses) IT use data data related to personal or professional characteristics solvency and bank data	legitimate interest

You are a partner, supplier or a consultant

You work as a representative for a supplier that provides products and services to TFS we process limited amounts of your personal data. This is used to evaluate your offering, manage a contract and provide you with access to relevant IT-systems.

Who processes the data (our local units or our head office?)	PURPOSE	PERSONAL DATA CATEGORIES	LEGAL GROUND	RETENTION
Head Office and Local units	evaluate a proposal from you or your employer and assess you as a business partner	Contact information (such as name, email, phone number, address) Organizational data (such as company name, country, company address and phone number) If you are a sole trader, we also process financial data such as credit ratings and prices Background information (such as personal or professional conditions and characteristics, financial data, connections to government officials and - if legally permitted – possible criminal offences	legitimate interest	Until end of our relationship with you
Head Office and Local units	perform contracts with you	Contact information (such as name, email, phone number, address) Organizational data (such as company name, country, company address and phone number, business organisation number) If you are a sole trader, we also process financial data such as credit ratings, bank accounts and payments	performance of a contract and legitimate interest	Until end of our relationship with you
Head Office and Local units	To provide access to our IT- systems	Contact information (such as name, email, phone number, address) User-id Language settings in systems and Logs of your usage of our systems	legitimate interest	Until end of our relationship with you
Head Office and Local units	identify you as a TFS business partner/supplier	Contact information (such as name, email, phone number, address) Employment data (such as employment number, User-ID, Photos)	legitimate interest	Until end of our relationship with you
Head Office and Local units	To communicate with yourself or your employer	Contact information (such as name, email, phone number, address) Organizational data (such as company name, country, company address, phone number and business organisation number)	legitimate interest	Until end of our relationship with you
Head Office and Local units	To analyse, improve and develop existing and new products and services, as well as our organization	Contact information (such as name, email, phone number, address) Organizational data (such as company name, country, company address, phone number and business organisation number) If you are a sole trader, we also process financial data such as credit ratings, bank accounts and payments Logs of your usage of our systems	legitimate interest	Until end of our relationship with you
Head Office and Local units	To comply with legal obligations and legitimate requests from law enforcement and other authorities	Contact information (such as name, email, phone number, address) Organizational data (such as company name, country, company address, phone number and business organisation number) Financial data such as credit ratings, bank accounts and payments as well as contractual related data such as contract number, order number, invoices Citizenship Date of birth License registration Access logs from IT-systems and entry systems, IT-logs from applications and network services	legal obligation or legitimate interest	Until end of our relationship with you
Head Office and Local units	To provide you with requested information and relevant updates	Contact information (such as name, email, phone number, address)	legitimate interest and local marketing law	Until end of our relationship with you
Head Office and Local units	To comply with licences of open-source programs	Contributors’ contact information (such as name, email, phone number, address)	performance of a contract	Until end of our relationship with you

You are a visitor

When you visit our premises and our events, we process personal data about you to be able to fulfil the purpose of your visit and make your visit successful and safe.

Head Office or local units?	PURPOSE	PERSONAL DATA CATEGORIES	LEGAL GROUND	RETENTION
Head office	To fulfil the purpose of your visit at TFS.	Contact information (such as name, email, phone number, address) Co-traveller information (such as name, email, phone number, address, age) Organizational data (such as company name, country, company address, phone number and business organisation number) Language Food preferences Travelling and lodging details Driver license Host details	legitimate interest	5 years after end of visit
Head office	protect our visitors and our company assets	Contact information (such as name, email, phone number, address) Access logs from IT-systems and entry systems, IT-logs from applications and network services, Camera surveillance Security incident report Health data	legitimate interest, consent	5 years after end of visit
Head office	To comply with legal obligations and legitimate requests from law enforcement and other authorities	Contact information (such as name, email, phone number, address) Co-traveller information (such as name, email, phone number, address, age) Organizational data (such as company name, country, company address, phone number and business organisation number) Language Travelling and lodging details Driver license Host details	legal obligation or legitimate interest	5 years after end of visit
Head office	To provide you with requested information and relevant updates incl. webcasts or annual reports	Contact information (such as name, email, phone number, address) Organizational data (such as company name, country, company address, phone number and business organisation number Language	legitimate interest and local marketing law	5 years after end of visit

You are an internet user

When you visit our websites, your web browser provides us with some information that helps us understand how you are using our websites, for example if you are using a mobile device or a computer, which region in the world you are surfing from and which browser you are using. This data helps us tailor our website and enhance your browsing experience. We use a limited number of cookies to help us understand how you are using our websites and you will find more information in TRATON’s cookie policy.

Head Office or local unit?	PURPOSE	PERSONAL DATA CATEGORIES	LEGAL GROUND	RETENTION
Head Office and local	Evaluate website usage and enhance our website	IP-address Browser settings Type of device used to access the site Areas of interest	legitimate interest	Consult TRATON’s cookie policy
Head Office and local	To enhance your browsing experience	IP-address Geo-location Browser type and version Operating system Date and time for you visit URL of the referring site Browsing country	legitimate interest	Consult TRATON’s cookie policy
Head Office and local	To provide you with directed information and campaigns	IP-address Geo-location Browser type and version Operating system Date and time for you visit URL of the referring site Browsing country	legitimate interest and local marketing law, consent	Consult TRATON’s cookie policy

Third parties, recipients and transfers

In order to perform our business, we at times entrust other companies outside TFS with the processing of your personal data. This may happen for several reasons and in different ways (directly, automatically, indirectly). Any transfer outside the EEA is vetted and assessed against the most recent jurisprudence of the EU Court of Justice. Below is a few examples of transfers to third parties:

For example, certain service providers offer us the opportunity to perform our business digitally. It is the case of certain cloud providers, BI providers, SaaS providers, etc. This includes certain loan and leasing applications, data platform services to execute regulatory reporting and other analytic services, data providers to perform KYC
Also, certain information is sometimes shared amongst entities of the TRATON or the Volkswagen Group to optimize business, including in the digital sphere. In limited times, such data may be accessed by subsidiaries within the TFS or VW Group outside the EEA area to fulfil IT maintenance and support
Other times, we are requested by governmental agencies and regulators to share our data with them to fulfil regulatory reporting obligations, particularly as members of the financial services ecosystem.