Aurora Innovation Privacy Statement

Aurora recognizes that privacy is vital to Aurora’s customers and to end-users and is committed to maintaining a high level of security and integrity regarding personal data. Aurora is also committed to ensuring that processing is carried out in accordance with applicable data protection legislation.

This Privacy Statement describes Aurora’s processing of personal data in its capacity as a controller and is aimed at:

Company representatives of Aurora’s customers
End-users of Aurora’s services
Company representatives of potential customers
Visitors of Aurora’s website
Other recipients of Aurora’s communications, e.g. recipients of Aurora’s newsletters

The objective of this statement is to provide information in accordance with applicable data protection legislation.

“Personal data” means any information that directly or indirectly relates to a natural, living person. Accordingly, personal data is information about you and your person, e.g. your name, your contact information, pictures of you and your IP-address. “Processing” means any operation which is performed on personal data, such as collection, storage, use, adaption or disclosure.

Data controller

The Aurora group comprises various entities that are responsible for their own processing operations. The data controller responsible for the processing of personal data depends on where the data subject is based:

Aurora Innovation AB, reg. no. 556237-9825 is the data controller for personal data relating to data subjects based in Sweden.
Aurora Innovation BV, reg. no NL853179839B01, is the data controller for personal data relating to data subjects based in the Netherlands.
Aurora Innovation Oy, reg. no 2406275-9, is the data controller for personal data relating to data subjects based in Finland.
Aurora Innovation SL, reg. no B88065636, is the data controller for personal data relating to data subjects based in Spain.

In this Privacy Statement, “Aurora” refers to the relevant data controller as set out above.

All Aurora entities can be reached at dpo@aurorainnovation.com. For further contact information, kindly refer to the Section “Contact Information” below.

Which personal data does Aurora process?

Aurora collects and processes the following categories of personal data about the categories of data subjects set out below.

Company representatives of Aurora’s customers

Personal information and contact information, such as name, personal identity number, address, telephone number, email address, title, position, and employer
Information that you provide to Aurora by email, via Aurora’s social media or by other channels of communication
Information from customer surveys and customer evaluations
Information regarding complaints and warranty matters
Where applicable, information regarding phone calls with Aurora’s customer service
Where applicable, information regarding participation at events, seminars, and meetings, whether in physical or digital format
Where applicable, information regarding dietary preferences, potential allergies and/or disabilities (e.g. in connection with corporate events or meetings)

End-users of Aurora’s services

Personal information and contact information, such as name, personal identity number, address, telephone number, email address, title, position, and employer
Information provided to Aurora by email, via Aurora’s social media or by other channels of communication
Information from customer surveys and customer evaluations
Information regarding complaints and warranty matters
Where applicable, information regarding phone calls with Aurora’s customer service
Where applicable, information regarding participation at events, seminars, and meetings, whether in physical or digital format
Where applicable, information regarding dietary preferences, potential allergies and/or disabilities (e.g. in connection with corporate events or meetings)

Company representatives of potential customers

Personal information and contact information, such as name, address, telephone number, email address, title, position, and employer
Information that you provide to Aurora by email, via Aurora’s social media or by other channels of communication
Where applicable, information regarding dietary preferences, potential allergies and/or disabilities (e.g. in connection with corporate events or meetings)

Visitors of Aurora’s website

Technical data and device information, such as IP address, MAC address, URL, unique device ID, network and device performance, browser, language and identification settings, geographic location, operating system, other information from cookies or similar mechanisms

Other recipients of Aurora’s communications

Personal information and contact information, such as name, address, telephone number, email address, title, position, and employer
Information that you provide to Aurora by email, via Aurora’s social media or by other channels of communication

Company representatives of Aurora’s suppliers and partners

Personal information and contact information, such as name, address, telephone number, email address, title, position, and employer
Information that you provide to Aurora by email, via Aurora’s social media or by other channels of communication
Where applicable, information regarding participation at events, seminars, and meetings, whether in physical or digital format
Where applicable, information regarding dietary preferences, potential allergies and/or disabilities (e.g. in connection with corporate events or meetings)

Job applicants

Personal information and contact information, such as name, personal identity number, address, telephone number, email address, title, position, and current employer
Information provided in cover letter, resume, and any other documents that you submit to Aurora
Where applicable, your picture
Other information that you provide to Aurora in connection with a recruitment process

From which sources does Aurora collect personal data?

With respect to company representatives of Aurora’s customers, end-users of Aurora’s services, company representatives of potential customers, other recipients of Aurora’s communications, and company representatives of Aurora’s suppliers and partners, the personal data is usually collected from the company or organisation represented, but also, in certain cases, directly from the data subject, e.g. by email, Aurora’s social media or other channels of communication or in connection with events or meetings. With respect to visitors of Aurora’s website and job applicants the personal data is usually collected directly from the data subject. Aurora may also receive personal data from other companies within the group that Aurora is part of or from Aurora’s partners. Aurora may also use external information services to supplement existing data.

For which purposes does Aurora process personal data, and what are the legal bases for such processing?

Aurora processes personal data for the following purposes and relying on the legal bases set out below.

Company representatives of Aurora’s customers

Purpose	Legal basis
To be able to keep in touch with customer representatives in connection with the provisions of and in regards to the services.	The processing is necessary for Aurora’s legitimate interest to keep in touch with customer representatives in order to fulfil its obligations under the customer agreement (legitimate interest).
To enable marketing and communication about Aurora's brand and Aurora's services. Such marketing activities include mailing of newsletters and other marketing materials, invitations to company events, meetings and other gatherings, and raffles.	The processing is necessary for Aurora’s legitimate interest to market its brand, its services and other similar products (legitimate interest). If and to the extent that any activity includes processing of special categories of data (e.g. information regarding allergies), such processing is carried out on the basis of the data subject’s consent (which will be requested in each case prior to any such activity).
To be able to create content for Aurora’s newsletter for the purpose of promoting Aurora’s brand and services.	The processing is based on the data subject’s consent, which will be requested in each case prior to any publication.
To carry out surveys regarding Aurora’s services and the customer experience.	The processing is necessary for Aurora’s legitimate interest to evaluate, develop and improve its brand, its services and its marketing (legitimate interest).
To be able to respond to complaints and warranty matters and to improve the quality of Aurora's customer service.	The processing is necessary for Aurora’s legitimate interest to develop its services, to keep in touch with company representatives in order to fulfill its obligations under the customer agreement, and to ensure the quality and efficient management of Aurora’s customer service (legitimate interest).
To fulfill legal requirements, e.g. security requirements and accounting requirements.	The processing is necessary for compliance with Aurora’s legal obligations.

End-users of Aurora’s services

Purpose	Legal basis
To be able to keep in touch with end-users in connection with the provisions of and in regards to the services, including to be able to provide information regarding e.g. the continuity and use of the services as well as changes, updates, and/or disruptions to the services.	The processing is necessary for Aurora’s legitimate interest to keep in touch with end-users in order to fulfil its obligations under the customer agreement as well as to enhance the end-user experience (legitimate interest).
To enable marketing and communication about Aurora's brand and Aurora's services. Such marketing activities include mailing of newsletters and other marketing materials, invitations to company events, meetings and other gatherings, and raffles.	The processing is necessary for Aurora’s legitimate interest to market its brand, its services and other similar products (legitimate interest). If and to the extent that any activity includes processing of special categories of data (e.g. information regarding allergies), such processing is carried out on the basis of the data subject’s consent (which will be requested in each case prior to any such activity).
To be able to create content for Aurora’s newsletter for the purpose of promoting Aurora’s brand and services.	The processing is based on the data subject’s consent, which will be requested in each case prior to any publication.
To carry out surveys regarding Aurora’s services and the customer experience.	The processing is necessary for Aurora’s legitimate interest to evaluate, develop and improve its brand, its services and its marketing (legitimate interest).
To be able to respond to complaints and warranty matters and to improve the quality of Aurora's customer service.	The processing is necessary for Aurora’s legitimate interest to develop its services, to keep in touch with end-users in order to fulfill its obligations under the customer agreement, and to ensure the quality and efficient management of Aurora’s customer service (legitimate interest).
To fulfill legal requirements, e.g. security requirements and accounting requirements.	The processing is necessary for compliance with Aurora’s legal obligations.

Company representatives of potential customers

Purpose

Legal basis

To enable marketing and communication about Aurora's brand and Aurora's services. Such marketing activities include mailing of newsletters and other marketing materials, invitations to company events, meetings and other gatherings.

The processing is necessary for Aurora’s legitimate interest to market its brand, its services and other similar products (legitimate interest).

If and to the extent that any activity includes processing of special categories of data (e.g. information regarding allergies), such processing is carried out on the basis of the data subject’s consent (which will be requested in each case prior to any such activity).

Visitors of Aurora’s website

Purpose	Legal basis
To ensure the operation of Aurora's website and application, as well as to be able to develop and adapt the website based on how it is used.	The processing is necessary for Aurora’s legitimate interest to improve, streamline, simplify and develop its website and to attract stakeholders and to increase the number of recurring visitors (legitimate interest).

Other recipients of Aurora’s communications

Purpose

Legal basis

The processing is necessary for Aurora’s legitimate interest to market its brand, its services and other similar products (legitimate interest).

Company representatives of Aurora’s suppliers and partners

Purpose

Legal basis

To be able to manage Aurora’s relationships with its suppliers and partners, and to keep in touch with representatives of suppliers and partners (e.g. in connection with the provision of products or services to Aurora).

The processing is necessary for Aurora’s legitimate interest to manage Aurora’s relationships with its suppliers and partners and to keep in touch with representatives of suppliers and partners in order to (i) fulfill its obligations under the agreement with the supplier or partner that the representative represents, and/or (ii) receive products or services pursuant to the agreement with the supplier or partner that the representative represents (legitimate interest).

To fulfil legal requirements, e.g. security requirements and accounting requirements.

The processing is necessary for compliance with Aurora’s legal obligations.

Job applicants

Purpose	Legal basis
To be able to evaluate job applicants and ensure that the job applicant has the necessary qualifications.	The processing is necessary for Aurora’s legitimate interest in recruiting qualified employees (legitimate interest).

For how long will Aurora store personal data?

Personal data is stored as long as there is a need to process them in order to fulfil the purposes for which the data was collected in accordance with this Privacy Statement. Thereafter, your personal data will be deleted or anonymized.

Some personal data will, for the purpose of complying with applicable accounting legislation, be stored for seven years, counting from the end of the calendar year during which the financial year, to which the information pertained, was terminated.

For more information about retention periods for specific personal data, please contact Aurora. Contact information is provided under the section "Contact information" below.

With whom does Aurora share personal data?

Aurora will not disclose personal data to third parties, except when such disclosure is necessary to fulfill a legal obligation or to fulfill Aurora's obligations to data subjects, to its customers, and/or to other stakeholders, or for the management of legal claims. Situations when your personal data may be disclosed to third parties are listed in the table below.

Third party	Reason for third-party disclosure
Other companies within the Aurora group	Personal data may need to be transferred to other companies within the Aurora group, since central functions such as marketing and finance are managed jointly within the group.
Suppliers of cloud solutions	Personal data may be transferred to suppliers of cloud solutions since Aurora stores certain information in cloud solutions.
Suppliers and partners	Aurora may disclose your personal data to suppliers and/or partners, if the suppliers and/or partners need your personal data to fulfil their undertakings toward Aurora.
Authorities	Personal data may be disclosed to authorities when necessary for compliance with Aurora’s legal obligations.
Sale	If Aurora intends to transfer all or part of its business, personal data may be disclosed to a potential buyer.

Where is personal data processed?

Aurora processes personal data in the EU/EEA. Through its use of certain IT suppliers, Aurora may however transfer your personal data to the following countries outside the EU/EEA: USA.

If personal data is transferred to a country outside the EU/EEA, Aurora will ensure that the transfer is legal, either on the basis that the Commission has decided that the third country in question ensures an adequate level of protection or, in the absence of an adequacy decision, on the basis of appropriate safeguards, such as binding corporate rules or standard contractual clauses.

For more information on the legal basis for a specific transfer, please contact Aurora. Contact information is provided under section "Contact Information" below.

How is personal data protected?

Aurora works diligently to protect data subject’s privacy. Particular attention is devoted to information security to prevent, deter, and detect the dissemination of data to unauthorized third parties and the loss of data. Access to data is provided only to those who need it to perform their duties. Data processing is logged and checked systematically.

Rights of data subjects

A summary of data subjects’ rights according to applicable legislation is set out in the table below.

Right of access	You have the right to access your personal data and to obtain a copy of the personal data concerning you that is processed by Aurora.
Right to rectification	If the personal data concerning you that is processed by Aurora is inaccurate, incomplete, or outdated, you have the right to obtain rectification of such personal data.
Right to erasure	You have the right to request the erasure of personal data concerning you. Unless Aurora has a legal basis to continue the processing of the personal data concerning you, such personal data will be erased.
Right to object	In certain circumstances you have the right to object against Aurora’s processing of your personal data.
Right to restriction of processing	In certain circumstances you have the right to obtain restriction of the processing of your personal data. Where processing has been restricted, Aurora may only under particular circumstances carry out other processing activities than storage in respect of the personal data.
Right to data portability	Where your personal data is processed on the basis of your consent or on a contract with you, you have the right to receive the personal data concerning you in a machine-readable format and request that those data are transmitted to another controller.
Right to lodge complaints with a supervisory authority	You have the right to lodge complaints with a supervisory authority (in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement) regarding Aurora’s processing of personal data regarding you. The Swedish supervisory authority is the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten), which can be contacted by email at imy@imy.se or by post at Box 8114, 104 20 Stockholm, Sweden.

Social media

As regards personal data that occurs and is processed on social media, such as Meta, Youtube and LinkedIn, we refer users to the policy provided by the respective service providers for information on how each service provider processes personal data.

Cookies

Aurora uses cookie-like techniques in order to provide certain functions on Aurora’s websites, as well as to develop and improve the websites and to provide a more personalised experience. Aurora uses cookies in accordance with Aurora's Cookie Policy.

If you do not share your personal data with Aurora

If you do not share your personal data with Aurora, Aurora will not be able to fulfill its legal or contractual obligations. For end users, this means that the end user in question will not be able to use Aurora’s services.

Changes

Aurora reserves the right to change this Privacy Statement at any time. In the event of changes to this Privacy Statement, Aurora will publish the amended Privacy Statement on its website with information on when the changes will come into effect and may also notify customer representatives, end users, and any other relevant persons in an appropriate manner.

Contact information

Please do not hesitate to contact Aurora if you have any questions about this Privacy Statement, the processing of your personal data or if you wish to exercise your rights under this Privacy Statement or applicable legislation.

Aurora Innovation AB

Registration number: 556237-9825

Postal address: Sidenvävargatan 11, 753 19 Uppsala, Sweden

Email address: dpo@aurorainnovation.com

Aurora Innovation BV

Registration number: 58783482

Postal address: Lange Kleiweg 6-28, 2288 GK Rijswijk, the Netherlands

Email address: dpo@aurorainnovation.com

Aurora Innovation Oy

Registration number: 2406275-9

Postal address: Bertel Jungin aukio 1, 02600 Espoo, Finland

Email address: dpo@aurorainnovation.com

Aurora Innovation SL

Registration number: B88065636

Postal address: Calle de Zurbano, 27, 28010 Madrid, Spain

Email address: dpo@aurorainnovation.com

Aurora Innovation Privacy Statement

Yhteystiedot

Käyntiosoite

Laskutusosoite