1. Effective/Last change of this Notice
This Notice has been issued on August 1, 2019. The last version of this Notice is October 15, 2026.
Should this Data Protection Notice be updated or modified in a material way, we will update the Effective/Last change date of this Notice. In addition, we will announce the notice about the new version of the document.
2. Scope
The intention of this Data Protection Notice (Notice) is to inform you the way we at Material Exchange work with personal data. It explains how we collect, store or otherwise process personal data for the purpose of engaging in business partnerships with organizations. This notice is in alignment with the General Data Protection Regulation (GDPR) and Swedish Act with Supplementary Provisions to the GDPR (SFS 2018:218), UK General Data Protection Regulation (UKGDPR) as well as any other jurisdiction to which this notice applies to.
Personal data means any information that relates to an identifiable individual, either directly or indirectly, such as name, email address, photo. Personal data does not include information that is anonymized.
Processing means any operation or set of operations which is performed on personal data, or on sets of personal data, such as collection, recording, storage, adaptation or alteration, erasure or destruction.
3. About Us
In this Notice “Material Exchange”, “ME”, “we” and “our” refers to MATERIAL EXCHANGE VENTURES AB SWEDEN located at c/o Jessica Eriksson Elgerudsvägen 7, 144 63 Rönninge, Sweden.
ME as an owner and operator of two platforms - Material Exchange Marketplace (MP), Digital Sourcing Platform (DSP), Sourcing Hub (SH) and Ask Frank acts as a processor when it processes personal data on behalf of its customers to operate the platforms and to perform work for them, including the work that Frank performs for a User; the companies using the platforms are the controllers of that data. ME acts as a controller for account administration (including registration and sign-in), for its own marketing and outreach, including introductions that ME sends to researched companies on its own behalf, for website and platform technologies, for live events and in the other situations described in this Notice.
Questions, concerns, complaints, or disputes regarding this Data Protection Notice, data protection at ME, or our compliance with applicable data protection laws and regulations may be sent to us by email at dataprivacy@material-exchange.com.
We have appointed a data protection officer, who is responsible for ensuring that the protection of your Personal Data or other information collected is carried out in accordance with this Notice. Our data protection officer is Aleksandar Ugljevarevic and his email address is aleksandar.ugljevarevic@material-exchange.com.
4. Personal Data We Collect
Personal Data you give to us
A. Registration
When you register with the MP,DSP or SH, ME collects information about you as instructed by your employer including but not limited to your name, your employer’s name, your work address (including your country location), your job title, password and your email address. We may also collect your personal email address, a personal mailing address, and a mobile phone number.
We process your personal information for registration administration, to deliver member benefits to members, and to inform our members of our services and products, ME-related events, content, and other benefits or opportunities associated with ME membership. The ME may also use this information to help the ME understand our members’ needs and interests to better tailor our products and services to meet your needs.
ME acts as a controller for registration purposes and legal basis for processing of personal data for registration purposes is contract (Terms&Conditions) you’ve accepted when registering on MP, DSP or SH.
B. Use of ME platforms
Registered users of MP, DSP or SH are providing personal data and process personal data of other users while using these platforms. When you use ME you are processing personal data of other Users including but not limited to your name, your employer’s name, your work address (including your country location), your job title, password and your email address. Other Users may also collect your personal email address, a personal mailing address, and a mobile phone number.
The main purpose of ME business is provided here, and ME is acting as processor in these processing activities.
C. Digital Scanning Services
When you wish to use Digital Scanning Service, ME collects information about you as instructed by your employer including but not limited to your name, your employer’s name, your work address (including your country location), your job title, your email address, phone number.
ME acts as a controller for registration purposes and legal basis for processing of personal data for registration purposes is contract (Terms&Conditions) you’ve accepted when registering on DSP/SH and separate agreement with ME.
D. Live Events/Working groups
ME hosts and participates in many live, online (ME Digital Material Show etc.) and in-person events throughout the year. ME also hosts different working groups for industry stakeholders. If you register for one of our events/working groups and you are a member, we will access the information in your member account to provide you with information and services associated with the event.
If you are not a member and you sign up for one of our events/working groups or check us at the event not organized by us, we will collect the following information: name, email, company information, title, address, phone number.
We may also make video recordings and take photographs at live events/working groups.
For these purposes ME acts as a controller and legal basis is either consent, contract, or legitimate interest.
E. Your correspondence with ME
If you correspond with us by email, notice boards, newsgroups, community feedback sites, forum facilities, chat rooms or other form of communication, we may retain such correspondence and the information contained in it and use it to respond to your inquiry; to notify you of ME conferences, publications, or other services; or to keep a record of your complaint, accommodation request, or similar concern. As always, if you wish to have the ME “erase” your personal information or otherwise refrain from communicating with you, please contact us at dataprivacy@material-exchange.com.
For these purposes ME acts as a controller and legal basis is either consent, or legitimate interest.
F. Customer Support
In order to provide customer support, we process following personal data: name, email address, device type, operating system, browser, correspondence, matter number and information about the relevant enquiry. The correspondence data may be processed for the purposes of communicating with you, analytic purposes and record-keeping. Our legal basis for processing personal data is our legitimate interests to enhance our services, provide better experience to customers and to communicate with the person that has reached out to our customer support.
We will retain the data for a maximum of 12 months following the termination of the relevant service agreement.
G. Survey
We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them. When we conduct surveys, we process following information: your name, your employer’s name, your work address (including your country location), your job title and your email address. We may also collect your personal email address, a personal mailing address, and a mobile phone number.
For these purposes ME acts as a controller and legal basis is consent.
H. Transaction details
We collect details of transactions you carry out and of the fulfilment of your orders, including licensing of software.
I. Payment card information
You may choose to pay for the ME membership using a payment card or QR code (WeChat, other). Typically, payment card information or QR code payment information is provided directly by users, into the PCI/DSS-compliant payment processing service to which ME subscribes, and the ME does not, itself, process or store the card information or information relate to the QR code payment. Payments for Ask Frank are processed by a third-party payment provider, whose terms also apply.
J. Communication with other users
ME platforms and especially SH is designed to provide high-end communication solution for its users. While users may leave certain personal data while using ME platforms, we do not ask for personal data. ME is processor in this case and fully provide security and privacy of communication.
K. Ask Frank
Ask Frank is the AI assistant that Users reach by email or web chat. When you use it, ME processes your email address and, where available, the name sent with your email. No phone number or password is needed: you sign in through a single-use link sent to your email address.
If you use WhatsApp, ME also processes your phone number, your messages and the media you send, such as photos, documents and voice notes.
ME also processes the content of your conversations, the files you send and the research that Frank prepares, including any business details you share in a request, so that you can return to your work. Frank uses AI tools and third-party providers to process messages and files.
Frank researches companies and may contact them on your behalf. For this it uses general business addresses that companies publish on their own websites, addresses you provide and the replies it receives. This includes personal data of individuals at those companies, such as their name, role, business email address and what they write in their replies.
When Frank performs work for a customer, ME processes personal data as a processor on behalf of that customer, whether Ask Frank is used independently or as part of the Sourcing Hub. ME acts as a controller for account administration and for its own marketing and outreach, as described elsewhere in this Notice.
Authorised ME staff may review relevant messages and files to help Users, to check outgoing communications or to resolve problems. This access is limited to what is necessary for those purposes and is logged.
A company or person contacted by Frank may object to further contact by replying to the message or by writing to kontaktinfo@material-exchange.com. ME will then stop further outreach to that address without undue delay.
Personal information we get from third parties
From time to time, the ME receives personal information about individuals from third parties. This may happen if you are employee, contractor, member, agent or other participant of an organization which is a member of ME and signs you up for membership.
We may collect information that is provided to ME by third parties such as our business partners, in the course of ME providing and supporting ME’s products and services.
What happens if you don’t give us your data
You can enjoy many of ME services without giving us your personal data. Much of the information on our website is available even to those who are not registered User. Some personal information is necessary so that the ME can supply you with the products or services you have purchased or requested, and to authenticate you so that we know it is you and not someone else.
5. ME website
ME’s website collects certain information automatically and stores it in log files. For more info, please visit our Website Policy.
6. Purpose and Lawfulness of Processing
In general, we will only process personal data where the processing is in our legitimate business interests or required to perform a contract with you or our corporate client. We will only use and share personal data in ways that are relevant for the purposes for which the information was collected or subsequently authorized by you. By agreeing to the Terms & Conditions you are entering into a contract with us. We process your personal data for the purpose of entering and performing that contract.
7. Legitimate Interest
It is in our interest to develop our business and to provide our members with the best possible service in a safe and secure way. Our interest to process your personal data does not override your interests or fundamental rights and freedoms.
Our legitimate interest to use your personal data is necessary in the following situations:
- To service your account, manage complaints and resolve any disputes;
- To service our member’ needs, including delivering our products and services;
- To enhance our services and customer experience;
- To ensure that content from our site is presented in the most effective manner.
- To promote and market our products and services.
- To get the insights and feedback on industry news and product development to develop the best possible product.
- To allow you to participate in interactive features of our service, when you choose to do so.
- To notify you about changes to our service, updates to our site, new ME product offerings or special events hosted or sponsored by ME or its business partners.
- In order to enforce or apply our terms of use of our site, our software licenses, hosted services, and other agreements.
- To protect the rights, property, or safety of ME, our members, or others.
- To provide you with updates on any events you are registered to attend or interested in.
- If you attend or speak at any of our events/working group or events that we attend as a sponsor, we may make video recordings of such events for use in promotional and educational material.
- To understand our members including their patterns, behaviours as well as their likes and dislike.
- Otherwise gather information about individual users of our products, services, and market segments.
We may provide information to you in the form of emails, mailings, website displays or other correspondence methods.
We are interested in your views, and we value feedback, and we may therefore set up notice boards, newsgroups, community feedback sites, email systems, forum facilities and/or chat rooms on our sites. Any information that you disclose via such facilities will be used in accordance with the terms of service for the particular forum and in the absence of such terms of service, this Notice. However, we can of course not control and be responsible for other parties’ use of the personal data which you make available to them through such facilities and otherwise on our sites. We encourage you to be careful about what personal data you share in this way.
You can at any moment object to the processing based on our legitimate interest by sending email to us at dataprivacy@material-exchange.com
8. Recipients of Personal data
Your personal data is shared internally during course of doing business. In addition, we share your personal data with the following:
- Our authorized resellers and business partners for the limited purposes of offering our products and associated services.
- Subcontractors, external consultants, lawyers, bookkeepers, commercial banks, and other third parties such as :
- IT cloud, hosting, infrastructure and support providers.
- Chatbot.
- AI and language-model providers that process messages and files for Ask Frank.
- Companies that Frank contacts on your behalf, to the extent set out in the Terms.
- A new owner after a potential merger, acquisition, sale, or transfer of some or all of ME business, or after any other change in ownership status.
- Any other recipient, if we are required to do so, such as by applicable court order or law, or in order to enforce or apply our terms of use of any of our sites and other agreements; or to protect the rights, property, or safety of ME, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
All recipients are required to have appropriate technical and organizational measures in order to ensure the protection of your personal data and your rights. ME has entered into Data Processing Agreements with its processors.
It is ME’s policy to never sell your information to list brokers or similar entities for commercial gain.
9. Transfer of Personal Data
ME has its headquarters in Sweden. Sweden is part of the EU, and thus ME complies with the GDPR requirements when processing your personal data. However, ME is providing services in multiple countries around the world so transfer of personal data to other countries occurs.
The personal data can flow without any safeguards necessary to third countries from EU and those countries that have been recognized by the EU, as having adequate protection for personal data. If personal data is transferred to a country not in EU or to a country which does not possess adequate protection for personal data, ME shall provide appropriate safeguards (e.g. signed standard protection clauses).
10. Storage Period
ME retains data for as long as the customer’s account or subscription is active and for a limited period afterwards, to allow accounts to be restored, to comply with legal and accounting obligations, to handle claims and disputes, and to keep the records needed to provide and secure the services. For more information on where and how long your personal data is stored, and for more information on your rights of erasure and portability, please contact dataprivacy@material-exchange.com.
11. Data Integrity
We will take reasonable steps to ensure that personal data that we process is reliable for its intended use, accurate, complete, and current. You are responsible for the accuracy of all personal data you provide to us. We will use reasonable efforts to maintain the accuracy and integrity of the personal data we obtain, and to update it as appropriate. We will take reasonable steps to ensure that personal data is reliable for its intended use.
12. Security
We have implemented, and will maintain current, reasonable physical, technical, and organizational security measures for the purpose of protecting the personal data in our possession from loss, misuse, and unauthorized access, disclosure, alteration, or destruction.
Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
Unfortunately, the transmission of information via the internet is not completely secure. Although we have security measures in place to protect your personal data, we cannot guarantee the security of your data transmitted to our sites; any transmission is at your own risk. However, ME uses its controlled processes and employs highly responsible individuals to regularly enhance security measures in order to protect your personal data.
13. Limitation on Scope of Privacy Principles
Adherence by ME to this Notice may be limited to the extent required to meet a legal, governmental, national security, or public interest obligation.
14. Compliance and Enforcement
ME will conduct periodic internal compliance audits of our relevant privacy practices to verify adherence to this Notice. We encourage individuals covered by this Notice to raise any concerns they have about the way we process their personal data by contacting us at the address below.
ME commits to resolve questions and complaints about your privacy and its collection or processing of your personal data. Individuals who believe that ME is not complying with the terms of this Notice, can contact ME by email at dataprivacy@material-exchange.com. We will answer any questions and to investigate any concerns or complaints. We will do our best to internally resolve any complaints and disputes regarding the use and disclosure of personal data brought to our attention.
We have appointed a data protection officer, who is responsible for ensuring that the protection of your Personal Data or other information collected is carried out in accordance with this Notice. Our data protection officer is Aleksandar Ugljevarevic and his email address is aleksandar.ugljevarevic@material-exchange.com.
15. We do not Knowingly Collect Information from Children who are Under 16
Our site is not directed to children younger than age sixteen (16). We do not knowingly collect personal data from children under these ages on any of our sites and we will delete any such information later determined to be from such young person, unless we have received consent to collect such personal data from the child’s parent or guardian. In the event a parent or guardian believes that his/her child has provided information to ME and wishes that data to be removed or corrected, please contact ME as described below.
16. Your rights
As a data subject you have the following rights, if ME is the controller:
- Be informed. You as data subjects have a right to know how we process your personal data (this right has been met by providing you with this privacy notice).
- Access. Request access to your personal data we process. If your request to us for access to your data is in electronic form, we will respond in the same way, unless your request a different response.
- Rectification. Ask to have inaccurate data held about you rectified without undue delay. Please notify us if your personal details change or if you become aware of any inaccuracies in the personal data, we hold about you.
- Erasure. Request erasure of personal data (except to the extent as may be limited, excused or prohibited by applicable law) without undue delay. If you wish to delete your account with Ask Frank, SH, MP or DSP please contact our Help Centre at support@material-exchange.com.
- Data Processing Restriction. You can request that we restrict processing of your data.
- Object to the processing of your personal data. Where the processing is carried out on the grounds of our legitimate interests, or for direct marketing, including profiling, you have a right to be informed and provided the option to object the processing.
- Request data portability. Should the processing of your personal data be carried out by automated means and you provided that data based on consent, or the processing is necessary for the performance of a contract, and should you requests it, we will (i) provide you with the data in a structured, commonly used and machine-readable format and, (ii) allow the transmission of the data to another data controller.
Reasonable access to your personal data will be provided at no cost to ME members, and others upon request made to ME at dataprivacy@material-exchange.com. If access cannot be provided within a reasonable time frame, ME will provide you with a date when the information will be provided. If for some reason access is denied, ME will provide an explanation as to why access has been denied.
In case you consider that any of these rights is not respected or that we act against the law, please contact us. You can also file a complaint with the relevant data protection authorities.
In situation where ME is the processor, please address your request to the member as the controller and if necessary, it shall instruct us how to comply with it.
Opt-Out of E-Mail Correspondence and Access and Correct the Information we collect
In certain circumstances you may have the right to ask us not to process your personal data (“opt-out”). We will usually inform you (before collecting your data) about that. If you want to opt-out please contact as set out below.
You may also opt-out of future marketing correspondence by updating your preferences using the link on the footer of e-mail correspondence.
Upon request, we will provide you with reasonable access to personal data about you in our possession, and will take reasonable steps to permit you to correct, amend, or delete personal data that you demonstrate to be inaccurate or incomplete. If you have a https://material-exchange.com/ online account, you may access the data that https://material-exchange.com/ has recorded and update or correct the information at any time. You may also opt-out of future correspondence by updating your preferences. To do this go to https://material-exchange.com/ and visit your accounts. If you don’t have an account or are unable to locate your account information, you can create one or you may request a copy of the personal data we have stored and/or exercise your opt-out right by contacting dataprivacy@material-exchange.com. When updating personal data about you, we may ask you to verify your identity before we can act on your request.
We may reject requests that are fraudulent, unreasonably repetitious, require disproportionate technical effort (for example, developing a new system or fundamentally changing an existing practice), or would be extremely impractical (for example, requests concerning information residing on backup tapes).
In some instances we shall provide unsubscribe option in email we are sending to you, which is the simplest way to opt-out.
Where we can provide information access and correction, we will do so at no cost to you, except where it would require a disproportionate effort. We aim to protect information from accidental or malicious alteration or destruction. Accordingly, after your information is deleted, we may not immediately delete residual copies from our active servers or remove information from our backup systems.
17. Consent and withdrawal
You can withdraw the consent for processing your personal data that you have given us at any time. We will act on it immediately and stop the processing. This is free of charge. You can send us the request for withdrawal at dataprivacy@material-exchange.com.