Privacy Policy

(“Nicoya”, “we”, ”our” and ”us”) is a business-accelerating investment company focusing on foodtech. We are driven by creating meaningful impact for people, planet, and health. Nicoya is where emerging revolutionary foodtech concepts are developed before landing on consumers’ plates. Together with passionate entrepreneurs we will be part of the force transforming the global food system.

We at Nicoya care about your privacy and want you to feel safe when we process your personal data.

With this privacy policy, we want to provide information of our processing of personal data to you when you:

- communicate with us, or

- subscribe to our newsletter.

Below you can find information on how and why we process your personal data, the lawful basis for our processing and the storage period for which we keep your personal data. The information also describes your rights. Your rights are the right to object, the right to access, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, the right to withdraw your consent and the right to lodge a complaint with a supervisory authority. A detailed description of your rights is set out below. Our goal is to be as transparent as possible regarding our processing of your personal data.

In short: Why do we process your personal data?

- If you interact with us, e.g. by sending us an e-mail or via our social media, we process your personal data to e.g. communicate with you, and

- If you subscribe to our newsletters, your personal data will be processed to send newsletters to you and analyse how our newsletters are used to improve and develop them

A detailed description of our processing of your personal data is set out in the different sections below. By clicking on the links above you can read more about each specific scenario.

In this Policy, you can read more about the following:

  1. Nicoya is responsible for the processing of your personal data

  2. Which personal data do you need to share with us?

  3. What are your rights when we process your personal data?

  4. Balancing of interests assessments when processing personal data based on the lawful basis “legitimate interests”

  5. How do we process your personal data?

  6. Who can gain access to your personal data and why?

  7. Where are your personal data being processed?

Nicoya is responsible for processing of your personal data

Nicoya AB (publ), a Swedish company with company registration number 559279-3862, is responsible for the processing of your personal data as controller when you share your personal data with us.

Should you have any questions regarding our processing of your personal data, or if you wish to exercise any of your rights under data protection legislation, please contact us via our e-mail address info@nicoya.se. Our postal address is Biblioteksgatan 11, 111 46, Stockholm, Sweden.

Which personal data do you need to share with us?

In general, you are not required to provide any of your personal data to us. However, if you want to communicate with us or subscribe to our newsletter, we need some of your personal data in order to communicate with you, to provide our newsletter to you and to comply with statutory requirements.

You will find a description of the scenarios when you need to provide your personal data to us and what personal data you need to provide in the tables below where the lawful basis is ”Performance of contract” or ”Legal obligation”. If you do not provide your personal data to us in such scenarios, you will for example not be able to communicate with us or get our newsletter.

What are your rights when we process your personal data? Detailed description

You have certain rights that you can exercise to affect how we process your personal data. You can read a more detailed description about what those rights are below.

If you want to know more about your rights or if you want to exercise any of your rights, please contact us and we will help you. Our contact information can be found at the beginning of this privacy policy.

Right to object (Article 21 GDPR)

You can at any time object to our processing of your personal data.

The right applies when your personal data is performed for marketing purposes, i.e. when we send newsletters.

The right applies as well when the processing of your personal data is performed based on our legitimate interests and on grounds relating to your particular situation. The right means that we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Right to access (Article 15 GDPR)

You have the right to obtain confirmation as to whether we are processing personal data about you or not. If we do process your personal data, you also have a right to obtain a copy of the personal data processed by us as well as information about:

- the purposes of the processing;

- the categories of personal data concerned;

- the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

- where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; 3

- the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing;

- the right to lodge a complaint with a supervisory authority;

- where the personal data are not collected from you, any available information as to their source;

- the existence of automated decision-making, including profiling, referred to in Article 22.1 and 22.4 GDPR; or

- where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer.

You also have the right to be provided one copy of the personal data undergoing processing. For any further copies requested by you, we may charge a reasonable fee based on administrative costs. If you have made the request by electronic means the information will be provided to you in a commonly used electronic form, unless otherwise requested by you.

You can make a request by contacting us by our contact information can be found at the beginning of this privacy policy.

Right to rectification (Article 16 GDPR)

You have a right to obtain, without undue delay, the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including be means of providing a supplementary statement.

We will notify each recipient to whom the personal data has been provided to of any correction that has been made, unless this turns out to be impossible or entails a disproportionate effort. If you want information about these recipients, you are welcome to contact us. You will find our contact information at the beginning of this privacy policy.

Right to erasure (“the right to be forgotten”) (Article 17 GDPR)

You shall have the right to obtain from us the erasure of your personal data without undue delay and we have the obligation to erase your personal data without undue delay where one of the following grounds applies:

- the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;

- you withdraw your consent on (according to Article 6.1 a) and where there is no other legal ground for the processing;

- you object to the processing pursuant to Article 21.1GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21.2 GDPR;

- the personal data have been unlawfully processed;

- the personal data have to be erased for compliance with a legal obligation in Union or Member State law which that applies to us; or

- your personal data have been collected in relation to the offer of information society services referred to in Article 8.1 GDPR.

If we have made the personal data public and is obliged pursuant to erase the personal data according to above, we, taking account of available technology and the cost of implementation, shall take the reasonable steps, including technical measures, to inform controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication, those personal data.

Note that our obligation to erase and inform according to above shall not apply to the extent that processing is necessary according to the following reasons:

- for exercising the right of freedom of expression and information;

- for compliance with a legal obligation which requires processing by Union or Member State law which applies to us; or

- for the establishment, exercise or defence of legal claims.

We erase your personal data at your request, if we do not have an obligation to store personal data in accordance with applicable laws and regulations.

We will notify each recipient to whom the personal data has been provided to about any erasure according to above, if this do not occur to be impossible or entails a disproportionate effort. If you want more information about these recipients, you are welcome to contacts us. You will find our contact information at the beginning of this privacy policy.

Right to restriction of processing (Article 18 GDPR)

You have the right to obtain from us restriction of processing if:

- the accuracy of the personal data is contested by you (thus only during a period enabling us to verify the accuracy of this);

- the processing is unlawful, and you oppose the erasure of the personal data and requests the restriction of their use;

- you need the personal data for the establishment, exercise or defence of legal claims even though we no longer need the personal data for the purposes of the processing; or

- you have objected to processing pursuant to Article 21.1 GDPR pending the verification whether our legitimate grounds override yours.

Where the processing has been restricted according to above, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence or legal claims of for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. We will notify you before the restriction of the processing end.

We will notify each recipient to whom the personal data has been provided to about any restriction of processing according to above, if this do not occur to be impossible or entails a disproportionate effort. If you want more information about these recipients, you are welcome to contacts us. You will find our contact information at the beginning of this privacy policy.

Right to data portability (Article 20 GDPR)

You have the right to receive your personal data from us in a structured, commonly used and machine-readable format and, where technically feasible, have your personal data transferred to another company (“data portability”). This applies to personal data that you have provided to us in a structured, commonly used and machine-readable format, if our processing of your personal data is based on the lawful basis consent (Article 6.1 a) or contract (Article 6.1 b) GDPR) and the processing is carried out by automated means.

The exercise of the right to data portability shall not be without prejudice to Article 17 GDPR. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested by us.

Your right to data portability shall not adversely affect the rights and freedoms of others.

Right to withdraw consent (Article 7.3 GDPR)

You have the right to withdraw your consent at any time, which you have given to one of our processing’s based on the legal ground consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

You have the right to lodge a complaint with a supervisory authority (without prejudice to any other administrative or judicial remedy), in particular in the EU/EEA member state of your habitual residence, place of work or place of the where the alleged infringement of applicable data protection laws has allegedly occurred.

Balancing of interests assessments when processing personal data based on the lawful basis “legitimate interests”

As we state above, for some purposes, we process your personal data based on our “legitimate interest”. By carrying out a balancing of interests assessment concerning our processing of your personal data, we have concluded that our legitimate interest for the processing outweighs your interests or rights which require the protection of your personal data.

If you want more information in relation to our balancing of interests assessments, please do not hesitate to contact us. Our contact information can be found at the beginning of this privacy policy.

Detailed description about how we process your personal data

How do we process your personal data?

You can read more about how we process your personal data in the tables below. As we are legally required to provide some of the information to you, the text is extensive and may be perceived as difficult to understand. If you have any questions regarding the information set out herein, do not hesitate to contact us.

The below tables describe in detail (i) when we process your personal data (ii), what kind of data we process, (ii) why we process your personal data, (iv) how long we will process your personal data and (v) the lawful basis for the processing. The lawful basis is the basis for processing your personal data according to the GDPR.

If you interact with us e.g. by sending us an e-mail or via our social media

If you are in contact with us e.g. by sending us an e-mail or sending us a message via our social media, we will process your personal data as described in the tables below. We process the personal data that you provide to us and information from your social media account (if you use such account to communicate with us).

When contacting us through a social media platform, we suggest that you also read the privacy information of that platform. To communicate with you

What processing we perform

What personal data we process

Our lawful basis for the processing

- Communicate, e.g. via e-mail

- Communicate via social media, e.g. if you make a comment on our site or posts

- Answer your questions and give you the best possible service

- Information you provide to us (e.g. name and contact information)

If you interact with us via our social media sites (e.g. our Instagram or LinkedIn) we also process:

- Information from your profile on the social media in question (user name and any picture you have chosen for your account)

- Other information regarding the matter for which you contact us

Legitimate interest

The personal data will be processed based on our legitimate interests to communicate with you who have contacted us.

Storage period: We will delete your personal data upon your request.

  • If you chat with us via Instagram Direct Messenger, your personal data will be deleted upon your request, unless you choose to continue to communicate with us by e.g. entering your e-mail address.

  • If you contact us via e-mail, your personal data will be stored in order for us to give you the best possible service, unless you request that we delete it after the matter has been solved.

  • Your communication with us on social media (e.g. comments) can be deleted by you at any time. We will remove posts or comments which are in breach of the rules of the platform or in conflict with applicable legislation as soon as possible.

If you subscribe to our newsletters

Below describes how we process your personal data if you subscribe to our newsletters. We gather your personal data directly from you and provide some personal data ourselves by analysing how you use our newsletters.

To send newsletters:

What processing we perform

What personal data we process

Our lawful basis for the processing

- Send information via e-mail about news, marketing, offers, discounts and invitations (“newsletters”) to you who have chosen to subscribe to our newsletters

- Improve and develop our newsletters by analysing how you open them and what you click on in the newsletters. We may also use information about your birth date to analyse our marketing

- E-mail address

- Information about how you open our newsletters and what you click on

- Consent

- The personal data will be processed based on your consent. You can withdraw such consent at any time.

Storage period: You can choose to unsubscribe or object to receiving newsletters and marketing at any time. If you object to receiving marketing from us, we keep track of this in our “unsubscribe list” to avoid sending you any further marketing material.

If you have objected to receiving marketing from us

We will store information about you who have objected to receiving marketing from us. We have received the personal data from you.

 

To comply with marketing legislation: 

What processing we perform

What personal data we process

Our lawful basis for the processing

- If you have stated that you do not wish to receive marketing from us, we will store such

information in an “unsubscribe-list” to make sure we do not send any marketing to you

- Name

- E-mail address

- Phone number

- Legal obligation The processing is necessary to comply with legal obligations to which we are subject, i.e. marketing law which requires us to not send marketing material to individuals who have objected to receiving such marketing. We cannot make sure you will not receive marketing from us without processing your personal data for this purpose and you are therefore required to provide your personal data to us.

 

Storage period: You will be listed in our “unsubscribe-list” until further notice.

 

Who can gain access to your personal data and why?

 

Your personal data is initially collected and processed by us and we do not sell your personal data. This means that your personal data will be handled by our employees, but only personnel who need such access to conduct their work.

To conduct our business, we need to work with suppliers and partners who will process your personal data. We are responsible for any sharing of your personal data and to make sure your personal data is safe when shared with third parties as set out below.

 

We will share your personal data with our data processors. A processor processes data only on our behalf, which means that we are still responsible for the data they are processing.

 

We will share your personal data with our IT suppliers, e.g. for web development and hosting, who will process the personal data on our behalf and on our instructions to ensure good and secure IT operations. We only share your personal data with our IT suppliers if it is necessary for them to fulfil their obligations towards us according to the contract that we have with them. If you only use our social media platforms or visit our website, we will not share your personal data with our IT suppliers.

 

If you interact with us or visit our social media accounts, the social media platform that you use will process personal data about you as a user as a controller.

If you have any questions regarding how we share your personal data or want to know more about who we share your personal data with, please feel free to contact us.

 

Where are your personal data processed?

We only process your personal data within the EU/EEA. If you want to know more about what safeguards we implement for transfers of personal data or receive a copy of the safeguards you are always very welcome to contact us. Our contact information can be found at the beginning of this privacy policy.