Boydens Vietnam part of Sweco and its entities are members of the Sweco AB international network.

Sweco AB (hereinafter “Sweco”, “Boydens Vietnam part of Sweco”, “we”, “us” or “our”) is processing your personal data when you interact with us in various contexts. The controller for the processing described in this privacy notice is the Sweco AB group entity that has provided you with this privacy notice.

We respect your privacy and protect the personal data we process about you. All processing of personal data is carried out in accordance with the requirements set out in in the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the Vietnamese Government Decree No. 13/2023/ND-CP on personal data protection and other applicable personal data protection legislation.

We may at our own discretion update this privacy notice at any given time (see at the end the date this notice was last updated). If material changes are made, we will provide notice on this website prior to the change becoming effective.

Throughout this privacy notice the term “processing” is used to cover all activities involving your personal data, including e.g. collecting, handling, storing, sharing, accessing, using, transferring and disposing of your personal data. The term “personal data” refers to any information relating to an identified or identifiable natural person.

You may read this notice as a (i) website visitor, (ii) supplier representative or employee, (iii) client representative or employee, (iv) job candidate, (v) prospective client contact or (vi) government, public authority or international organization officials or employees. To make this notice more relevant to you, the notice is divided into sections with specific information related to the various roles that you may have when we are processing your personal data.

1. How do we collect your personal data?
   We collect the data directly from you or data that is generated by you, including your devices, when visiting our website.
2. Purposes of the processing of your personal data
   1. Maintain, protect and develop the website
      When you are browsing the website, we will process your IP address and browser user agent string to help spam detection. In addition, your personal data may be processed to administrate and improve this website, for our internal records and for statistical analysis. For more info about the way cookies and tracking are used on our websites, please read our cookie statement.

      Categories of personal data

      • IP address
      • Browser user agent string (UA)
   2. Communicate with you and respond to your questions or feedback
      Where we offer you a possibility to communicate with us by asking questions or providing feedback regarding our services and our business, we will process your personal data when you submit a question, comment, feedback or any other message. The purpose of the processing is to be able to communicate with you.

      Categories of personal data

      • Name
      • E-mail address
      • Address (if needed for communication)
      • Phone number (if provided by you)
      • Any information included in your message.
   3. Establish, exercise and defend legal claims
      For the purposes of establishing, exercising and defending legal claims (for example in connection with a dispute or legal process) we may process your personal data.
   4. Newsletters
      If you sign up for our newsletters, we will process your email address in order to send newsletters to you.
      Categories of personal data
      • Contact information
3. With whom do we share your personal data?
   1. General
      Where necessary in order to achieve the purposes set out in this Section 2, we share your personal data with other entities, authorities or actors. Please note however that we, regardless of the recipients’ capacity, only will share your personal data with entrusted actors and only to the extent necessary.
   2. Data processors acting on behalf of us
      In order to fulfil the purposes of the processing of your personal data and to be able run our business, we transfer personal data to external parties such as third-party service providers that we have engaged, as well as other partners. These external parties will act as our data processors and may only process your personal data in accordance with our instructions and not for their own purposes. We are the data controller for the processing of personal data that these external parties carry out on our behalf. The purposes of the processing activities carried out by us are outlined in Section 2.2.
4. For how long to we process your personal data?
   Your personal data will be processed for as long as necessary for the purposes described herein. For example, when processing your personal data for the purpose of maintaining the website, we will anonymize your data as soon as practicably possible and then use anonymized data for further website development. With respect to our communication with you, we will process your personal data for as long as it is relevant depending on the reason for our communication and with respect to our provision of newsletters, we will process your personal data until you opt-out from receiving the newsletters.

1. How do we collect your personal data?
   We collect the personal data that you, or the relevant supplier that you represent, have provided us within the scope of our business relationship with the supplier.
2. Purposes of the processing of your personal data
   1. Administration of supplier relationship
      Your personal data will be processed because we have a legitimate interest of administering the relationship with our suppliers and to be able to manage the overall cooperation and day-to-day activities relating to e.g. orders of products and services.

      Categories of personal data

      • Contact information
      • Identity data
   2. Communicate with you
      Within the scope of our commercial relationship, we will process your personal data when communicate through various channels. The purpose of the processing is to be able to communicate with you within the scope of the supplier relationship.

      Categories of personal data

      • Contact information
      • Identity data
      • Any information included in our communication with you
   3. KYC and other background checks
      When a supplier enters into a business relationship with Boydens Vietnam Part Of Sweco, we may process personal data regarding persons in management position of the supplier in order to carry out KYC or other background checks. Such controls are part of our standard procedures when procuring suppliers.

      Categories of personal data

      • Identity data
      • Contact information
      • Copy of ID
      • Financial information, e.g. information retrieved from background checks
   4. Sanctions screening
      Boydens Vietnam Part of Sweco may, before entering into a business relationship, carry out sanctions screening to ensure that Boydens Vietnam Part of Sweco is not entering into a business relationship with anyone that is subject to EU or UN sanctions.

      Categories of personal data

      • Identity data
      • Contact information
      • Potential data retrieved from sanctions screening, which may include criminal data.
   5. Establish, exercise and defend legal claims
      For the purposes of establishing, exercising and defending legal claims (for example in connection with a dispute or legal process) we may process your personal data.
   6. Sharing information with public authorities and international organizations and conducting internal investigations in case of suspected law violations
      We may process your data for purposes of bidding for or participating in projects that involve public authorities and/or international organizations, and cooperating with such public authorities and international organizations to prevent and counter criminal activity, breaches of contract, and other violations. In pursuit of this objective, it may be necessary to transfer certain necessary data to public authorities or international organizations for the purpose of their lawful investigations and proceedings. Such transfers will be exceptional, and the scope of the transferred data will be limited to what is necessary for conducting the relevant investigation or proceedings. We may also process your data for purposes of conducting internal investigations in the case of suspected violations of applicable laws.
3. With whom do we share your personal data?
   1. General
      Where necessary in order to achieve the purposes set out in this Section , we share your personal data with other entities, authorities, actors or international organizations. Please note however that we, regardless of the recipients’ capacity, only will share your personal data with entrusted actors and only to the extent necessary.
   2. Data processors acting on behalf of us
      In order to fulfill the purposes of the processing of your personal data and to be able to run our business, we transfer personal data to external parties such as third-party service providers that we have engaged, as well as other partners. These external parties will act as our data processors and may only process your personal data in accordance with our instructions and not for their own purposes. We are the data controller for the processing of personal data that these external parties carry out on our behalf. The purposes of the processing activities carried out by us are outlined in Section 3.2.
4. For how long to we process your personal data?
   Your personal data will be processed for as long as necessary for the purposes described herein, which generally is for as long as you are the representative of our supplier or for as long as we have an ongoing business relationship with the company you represent. When carrying out KYC and background checks we will delete any personal data as soon as possible after we have assessed the result. With respect to sanctions screenings or other legal obligations, we will process personal data for as long as there is a legal obligation to do so.

1. How do we collect your personal data?
   We collect the personal data that you, or the client that you represent, have provided us within the scope of our business relationship with the client.
2. Purposes of the processing of your personal data
   
   1. Administration of client relationship
      Your personal data will be processed because we have a legitimate interest of administering the relationship with our clients and to be able to manage the overall cooperation and day-to-day activities necessary to provide our products and services.
      Categories of personal data
      • Contact information
      • Identity data
   2. Provide support service
      We will process contact details relating to contact persons representing our clients that contact us for support. Your personal data will be processed because we have a legitimate interest of providing support for our clients and enabling usage of our services.

      Categories of personal data

      • Contact information
      • Identity data
   3. Sanctions screening
      Boydens Vietnam Part of Sweco may, before entering into a business relationship, carry out sanctions screening to ensure that Boydens Vietnam Part Of Sweco is not entering into a business relationship with anyone that is subject to EU or UN sanctions.

      Categories of personal data

      • Identity data
      • Contact information
      • Potential data retrieved from sanctions screening, which may include criminal data.
   4. Establish, exercise and defend legal claims
      For the purposes of establishing, exercising and defending legal claims (for example in connection with a dispute or legal process) we may process your personal data.
   5. Sharing information with public authorities and international organizations and conducting internal investigations in case of suspected law violations
      We may process your data for purposes of bidding for or participating in projects that involve public authorities and/or international organizations, and cooperating with such public authorities and international organizations to prevent and counter criminal activity, breaches of contract, and other violations. In pursuit of this objective, it may be necessary to transfer certain necessary data to public authorities or international organizations for the purpose of their lawful investigations and proceedings. Such transfers will be exceptional, and the scope of the transferred data will be limited to what is necessary for conducting the relevant investigation or proceedings. We may also process your data for purposes of conducting internal investigations in the case of suspected violations of applicable laws.
3. With whom do we share your personal data?
   1. Disclosure and transfer of personal data
      Where necessary in order to achieve the purposes set out in this Section , we share your personal data with other entities, authorities, actors or international organizations. Please note however that we, regardless of the recipients’ capacity, only will share your personal data with entrusted actors and only to the extent necessary.
   2. Data processors acting on behalf of us
      In order to fulfill the purposes of the processing of your personal data and to be able to run our business, we transfer personal data to external parties such as third-party service providers that we have engaged, as well as other partners. These external parties will act as our data processors and may only process your personal data in accordance with our instructions and not for their own purposes. We are the data controller for the processing of personal data that these external parties carry out on our behalf. The purposes of the processing activities carried out by us are outlined in Section 4.2.
4. For how long to we process your personal data?
   Your personal data will be processed for as long as necessary for the purposes described herein, which generally is for as long as you are the representative of our client or for as long as we have an ongoing business relationship with the company you represent. With respect to sanctions screenings or other legal obligations, we will process personal data for as long as there is a legal obligation to do so.

1. How do we collect your data?
   We collect your personal data from:
   • Yourself, which you submit to us when you apply for one of our positions, e.g. your CV and cover letter.
   • Publicly available sources, e.g. when carrying out background checks.
   • External recruiters, that have been involved in the recruitment process and that have provided us with information about you.
2. Purposes of the processing of your personal data
   1. Managing the recruitment process
      Your personal data will be processed by us within the scope of the general management of the recruitment process. Processing activities included in this process are e.g. collection of your personal data, review of CVs and cover letters, conducting interviews, evaluating you as a candidate and communicating with you within the scope of the recruitment process.
      Categories of personal data
      • Contact information
      • CV
      • Cover letter
      • Internal notes related to evaluating you as a candidate
   2. Job candidate evaluation process
      Within the scope of the recruitment, we carry out an evaluation process of potential employees. This may include background checks including and, where permitted under national legislation, criminal background check. The evaluation process may also include scanning of social media activity and other footprints on the internet.
      Categories of personal data
      • Identity data
      • Contact data
      • Skills data
      • Activity on social media and the Internet
   3. Concluding the employment agreement
      We will process your personal data in conjunction with the conclusion of the employment agreement with you e.g., when collecting references. Your personal data will also be processed in the employment agreement that we conclude and upon the initiation of the onboarding process. New employees will receive a more detailed internal privacy notice during onboarding.
      Categories of personal data
      • Contact information
      • Social security number
      • Organisational information, such as employer company, employment status, operational department, geographical placement, cost centre, organisation, place of employment
      • Salary
      • Benefits data
      • References
   4. Candidate database
      If you do not get the job that you have applied for, we may still have an interest in keeping your personal data to contact you in the event of future vacancies that suits your profile. We will only keep your personal data for this purpose if you consent to the processing.
      Categories of personal data
      • Contact information
      • CV
      • Cover letter
   5. Establish, exercise and defend legal claims
      For the purposes of establishing, exercising and defending legal claims (for example in connection with a dispute or legal process) we may process your personal data.
   6. Fulfil legal obligations
      Besides legal obligations within the field of employment, we will process your personal data for the purposes of fulfilling legal obligations related to work permit checks, including storage of related documentation.
      Categories of personal data
      • Identity data
      • Social Security number
      • Work permit documentation
3. With whom do we share your personal data?
   1. General
      Where necessary in order to achieve the purposes set out in this Section , we share your personal data with other entities, authorities or actors. The categories of recipients mentioned in Section 5.3.2 will process personal data on behalf of us in the capacity as data processors (i.e. such actors will only process your personal data in accordance with our instructions). The categories of recipients mentioned in Section will process personal data in the capacity as data controllers, i.e. these recipients will determine the purposes and means of the processing without our involvement. Please note however that we, regardless of the recipients’ capacity, only will share your personal data with entrusted actors and only to the extent necessary.
   2. Data processors acting on behalf of us
      In order to fulfill the purposes of the processing of your personal data and to be able to run our business, we transfer personal data to external parties such as third-party service providers that we have engaged, as well as other partners. These external parties will act as our data processors and may only process your personal data in accordance with our instructions and not for their own purposes. We are the data controller for the processing of personal data that these external parties carry out on our behalf. The purposes of the processing activities carried out by us are outlined in this Section .
4. For how long will we process your personal data?
   Your personal data will be processed for as long as necessary for the purposes described herein, which generally is for as long as you are in the recruitment process. However, if you do not get the job you applied for, we will store your personal data for as long as you may submit a legal claim related to the rejection of your application. If you agree to it, we may store your data in our candidate database for future recruitment processes. In such case, your data will be stored for up to one year after the recruitment process has ended.
5. More detailed information
   For more detailed information about the way your personal data is handled in your specific recruitment or talent acquisition process, please go to the information available via your local talent acquisition or recruitment channel.

1. How do we collect your data?
   We collect the data processed that has been provided by you, or any other representative with the prospect customer, within our process for evaluating, and communicating with, prospect clients.
2. Purposes of the processing of your personal data
   1. Management and administration of prospect clients
      We will process your personal data for the purpose of managing and administrating the overall process of approaching and evaluating prospect clients .
      Categories of personal data
      • Contact information
      • Identity data
   2. Marketing communication
      We will process your personal data for the purpose of marketing our services to your organization. You will be able to, at any time, opt-out from our marketing communication, in which case we will cease with our communication.
      Categories of personal data
      • Contact information
   3. Establish, exercise and defend legal claims
      For the purposes of establishing, exercising and defending legal claims (for example in connection with a dispute or legal process) we may process your personal data.
   4. Sharing information with public authorities and international organizations and conducting internal investigations in case of suspected law violations
      We may process your data for purposes of bidding for or participating in projects that involve public authorities and/or international organizations, and cooperating with such public authorities and international organizations to prevent and counter criminal activity, breaches of contract, and other violations. In pursuit of this objective, it may be necessary to transfer certain necessary data to public authorities or international organizations for the purpose of their lawful investigations and proceedings. Such transfers will be exceptional, and the scope of the transferred data will be limited to what is necessary for conducting the relevant investigation or proceedings. We may also process your data for purposes of conducting internal investigations in the case of suspected violations of applicable laws.
3. With whom do we share your personal data?
   1. General
      Where necessary in order to achieve the purposes set out in this Section , we share your personal data with other entities, authorities, actors or international organizations. The categories of recipients mentioned in Section 6.3.2 will process personal data on our behalf or in the capacity of data processors (i.e. such actors will only process your personal data in accordance with our instructions). The categories of recipients mentioned in Section will process personal data in the capacity as data controllers, i.e. these recipients will determine the purposes and means of the processing without our involvement. Please note however that we, regardless of the recipients’ capacity, only will share your personal data with entrusted actors and only to the extent necessary.
   2. Data processors acting on behalf of us
      In order to fulfill the purposes of the processing of your personal data and to be able to run our business, we transfer personal data to external parties such as third-party service providers that we have engaged, as well as other partners. These external parties will act as our data processors and may only process your personal data in accordance with our instructions and not for their own purposes. We are the data controller for the processing of personal data that these external parties carry out on our behalf. The purposes of the processing activities carried out by us are outlined in this Section .
4. For how long to we process your personal data?
   Your personal data will be processed for as long as necessary for the purposes described herein, which generally is for as long as we are in contact with you regarding a potential business relationship or if you decide to opt-out from the communication. In general, we will not store your data for longer than one year from our last communication, if we did not enter into a business relationship with the company you represent.

1. How do we collect your personal data?
   We collect the personal data that you, or the relevant government, public authority or international organization that you represent, have provided us within the scope of our professional, commercial or public law relationship.
2. Purposes of the processing of your personal data
   1. Administration of professional, commercial or public law relationship
      Your personal data will be processed because we have a legitimate interest of administering professional, commercial or public law relationships with an entity you represent and being able to manage the overall cooperation and day-to-day activities relating to e.g. our projects that the public authority or organization that you represent finance, co-finance or is otherwise involved in.
      Categories of personal data
      • Contact information
      • Identity data
   2. Communicate with you
      Within the scope of professional, commercial or public law relationship with an entity that you represent, we will process your personal data when communicating through various channels. The purpose of the processing is to be able to communicate with you within the scope of our relationship.
      Categories of personal data
      • Contact information
      • Identity data
      • Any information included in our communication with you
   3. Establish, exercise and defend legal claims
      For the purposes of establishing, exercising and defending legal claims (for example in connection with a dispute or legal process) we may process your personal data.
   4. Sharing information with public authorities and international organizations and conducting internal investigations in case of suspected law violations
      We may process your data for purposes of bidding for or participating in projects that involve public authorities and/or international organizations, and cooperating with such public authorities and international organizations to prevent and counter criminal activity, breaches of contract, and other violations. In pursuit of this objective, it may be necessary to transfer certain necessary data to public authorities or international organizations for the purpose of their lawful investigations and proceedings. Such transfers will be exceptional, and the scope of the transferred data will be limited to what is necessary for conducting the relevant investigation or proceedings. We may also process your data for purposes of conducting internal investigations in the case of suspected violations of applicable laws.
3. With whom do we share your personal data?
   1. General
      Where necessary in order to achieve the purposes set out in this Section 7, we share your personal data with other entities, authorities, actors or international organizations. Please note however that we, regardless of the recipients’ capacity, only will share your personal data with entrusted actors and only to the extent necessary.
   2. Data processors acting on behalf of us
      In order to fulfill the purposes of the processing of your personal data and to be able to run our business, we transfer personal data to external parties such as third-party service providers that we have engaged, as well as other partners. These external parties will act as our data processors and may only process your personal data in accordance with our instructions and not for their own purposes. We are the data controller for the processing of personal data that these external parties carry out on our behalf. The purposes of the processing activities carried out by us are outlined in Section 7.2.
4. For how long to we process your personal data?
   Your personal data will be processed for as long as necessary for the purposes described herein, which generally is for as long as you are the representative or employee of the respective government, public authority or international organization or for as long as we have an ongoing professional, commercial or public law relationship with the entity you represent.

Furthermore, we have signed the Sweco Intra-Group Data Processing Agreement (DPA) and Data Transfer Agreement (DTA) to comply with high organizational and technical standards regarding data protection.

We may also transfer your personal data to international organizations, in particular in connection with their investigations or proceedings relating to Boydens Vietnam Part of Sweco projects that these organizations finance or co-finance, or otherwise as needed to fulfill our contractual obligations on those projects or in the course of bidding for projects.

If you would like further details about the processing of your personal data and whether your personal data is transferred to a third country or an international organization, please contact us on the contact details as set out below under Section 10.

(i) right to know, (ii) right to consent, (iii) right to access, (iv) right to withdraw consent, (v) right to delete data, (vi) right to restrict data processing, (vii) right to request the provision of data, (viii) right to object to data processing (ix) right to complain, denounce and initiate lawsuits (x) right to claim compensation for damage, and (xi) right to self-defense.

1. Consent
2. Exceptions without consent
   In urgent cases where it is necessary to immediately process relevant personal data to protect the life or health of the data subject or others;Where the public disclosure of personal data is in accordance with the law;

   When the processing of data is done by competent state agencies in the event of a state of emergency on national defense, security, social order and safety, major disaster, or dangerous epidemic; or when there is a risk that threatens security and national defense but not to the extent where it is necessary to declare a state of emergency; or to prevent and combat riots, terrorism, crimes and violations of the law;

   To fulfill the contractual obligations of the data subject with relevant agencies, organizations and individuals as prescribed by law; or

   To serve the activities of state agencies as prescribed by sector-specific laws.

Email: privacyofficer@swecobelgium.be

Address: Sweco Belgium bv/srl, Arenbergstraat 13, bus 1, 1000 Brussels, Belgium