Personal data policy — goods handling

1. Purpose

This policy describes how Rewind Insure Technology AB processes personal data in connection with assignments where Rewind collects, receives, performs claims verification on, reuses, recycles or otherwise handles property on behalf of insurers or other clients. The policy has been drawn up to clarify Rewind's actual process, in particular the principles of data minimisation, short retention periods, restricted access and deletion of personal data when it is no longer needed.

2. Scope

The policy applies to Rewind Claims and equivalent goods handling where Rewind is engaged to collect and handle goods, for example in connection with insurance claims, transport damage, written-off property, reuse, recycling or sustainability reporting. The policy covers the personal data processing that takes place at Rewind from the moment an assignment is received until the collection has been completed and personal data is deleted in accordance with our established routine.

3. Rewind's role

Rewind's assessment is that Rewind is an independent data controller for the limited personal data processing that takes place within Rewind's own operational service. The insurer is the data controller for its insurance case, its claims handling, its customer relationship, its legal basis for disclosing data to Rewind and its decision to hand over a claim to Rewind.

Rewind processes personal data only in order to perform its own service — collection, logistics, receiving, claims verification, reuse, recycling, financial follow-up and sustainability reporting.

4. The process in brief

1. The insurer sends an assignment to Rewind by email, including the policyholder's contact details and information about the goods.
2. Rewind uses the details to book collection via a logistics partner and, where needed, to contact the policyholder about the collection.
3. Once the collection has been completed, the original assignment email and the personal data used are deleted. Deletion takes place no later than three working days after confirmed collection.
4. The claim is then handled in Rewind's system using an internal case number and details about the goods (category, status, financial outcome, reuse status, sustainability data).
5. At the end of each quarter, case numbers and item data are used for reporting back to the client — financial settlement and avoided CO₂e emissions (gross).

5. What personal data is processed?

Rewind may temporarily process the following personal data where needed to carry out the assignment:

• name
• address
• telephone number
• email address
• claim number or case number
• information about the goods or damage concerned
• any information required to book collection or transport

Rewind does not request more personal data than is needed to carry out the assignment.

6. What is the data used for?

• booking collection of property
• where needed, contacting the policyholder about collection
• coordinating transport with logistics partners
• receiving and registering the property
• linking the property to the correct claim during operational handling
• reporting financial outcome and sustainability data back to the client

Rewind does not use personal data for marketing, profiling or any other purpose unrelated to carrying out the assignment.

7. Legal basis

Rewind's processing takes place so that Rewind can carry out a received assignment and provide its operational service. The legal basis is normally a legitimate interest in being able to carry out collection, logistics and goods handling, and in fulfilling contracts with the client. To the extent that certain data must be retained for accounting, settlement or other statutory obligations, processing may also take place on the basis of a legal obligation.

8. Deletion and data minimisation

Rewind works on the principle that personal data should only be processed when needed and never retained longer than necessary. Once the collection has been completed, the original assignment email and any personal data no longer needed to carry out the assignment are deleted.

Deletion takes place no later than three working days after confirmed collection. After deletion, no name, address, telephone number or email address is retained in Rewind's systems for the claim in question.

9. Data retained after collection

After completed collection, Rewind retains only the data needed for continued handling of the property, financial follow-up, settlement, statistics and sustainability reporting:

• internal case number
• goods type, category, status
• financial outcome
• reuse or recycling status
• weight or other relevant sustainability data
• calculated avoided CO₂e emissions (gross)

After deletion, the internal case number is not linked to any name, address, telephone number or email address in Rewind's systems. The case number cannot be used by Rewind on its own to identify the policyholder.

10. Systems and storage

Rewind uses its own system together with Microsoft 365 and Google Workspace for case communication, documentation and operational handling. Personal data in assignment emails is handled only for as long as required to book and carry out the collection. After completed collection, the assignment email is deleted in accordance with this policy.

11. Logistics partners

In order to carry out a collection, Rewind may need to pass on the necessary contact and address details to logistics partners. Rewind uses established carriers such as Best Transport, DHL and PostNord. Only the data required to carry out the collection or transport in question is passed on. Logistics partners may not use the data for any purpose other than transport-related handling within the scope of the assignment.

12. Handling of electronics and stored information

When handling electronics (mobile phones, computers, tablets) that may contain stored information, Rewind does not access private content. Where relevant to the assignment, such property is handled through factory resetting, data erasure, destruction or other secure handling in accordance with Rewind's internal routines.

13. Security and access

Only those at Rewind who need the data to carry out the assignment have access to personal data. Rewind works with:

• restricted access to personal data
• internal confidentiality and instructions to relevant staff
• deletion of data when it is no longer needed
• secure and structured handling of case communication
• limited storage of personal data
• separation of personal data from reuse and reporting data after completed collection

14. Personal data breaches

If Rewind discovers an incident involving personal data, the incident is handled promptly in accordance with internal routines. If the incident concerns personal data received from an insurer or other client, the affected party is informed without undue delay.

15. Rights of data subjects

Under data protection legislation, a person whose data is processed has the right to request information about the processing and, in certain cases, to request rectification, erasure or restriction of processing, or to object to the processing.

If such a request concerns the insurer's claims settlement or customer relationship, Rewind refers the matter to the insurer in question. If the request concerns Rewind's own processing, the matter is handled by Rewind.

16. Contact

Company

Rewind Insure Technology AB

Address

Fabriksvägen 5, 245 34 Staffanstorp, Sweden

Contact person

Robin Fransson

Email

info@rewind.insure