Privacy Policy for FAGUS Forest Apps

Last updated: 4 September 2026

This Privacy Policy describes how personal data is processed when you use mobile applications (Android/iOS) and related services provided as part of FAGUS Forest solutions, including VSOP Mobil and customer-specific FAGUS Forest applications.

FAGUS Forest applications are developed and technically provided by CGI Sverige AB. The applications may be provided in customer-specific configurations and published by each customer through the customer's own Google Play or Apple App Store account.

Applications and customer organisations covered by this Privacy Policy

This Privacy Policy applies to VSOP Mobil and other customer-specific mobile applications based on the FAGUS Forest solution that refer to this Privacy Policy.

Bergkvist Siljan

Bergkvist Siljan is a customer-specific configuration of VSOP Mobil/FAGUS Forest that is developed and technically provided by CGI Sverige AB / FAGUS Forest on behalf of Bergkvist Siljan.

Bergkvist Siljan is the data controller for the processing of personal data carried out within the customer-specific service.

Billerud

SkogsägarAppen is a customer-specific configuration of VSOP Mobil/FAGUS Forest that is developed and technically provided by CGI Sverige AB / FAGUS Forest on behalf of Billerud AB.

Billerud AB is the data controller for the processing of personal data carried out within the customer-specific service.

Data Controller

The customer organisation that provides the relevant FAGUS Forest application to the user is the data controller for the processing of personal data carried out within the service.

If the customer organisation is part of a corporate group, the relevant group company may be the data controller depending on which legal entity provides the service or is responsible for the relevant customer or contractual relationship.

CGI Sverige AB / FAGUS Forest develops and technically provides the application and related services on behalf of each customer and processes personal data as a data processor and in accordance with the data controller's instructions.

Personal data and operational data are stored in the respective customer's environments and databases.

Information about which organisation is the data controller for your specific use of the application, together with current contact details, is provided above, within the application, or by the customer organisation that provided the application.

If you have questions about how your personal data is processed or wish to exercise your rights under applicable data protection legislation, you should primarily contact the relevant data controller.

For questions regarding this Privacy Policy or the technical processing of data by FAGUS Forest applications, please contact:

1. Personal data that may be processed

When using our applications, the following categories of personal data may be processed:

• Name and other user information.
• User ID or another identifier linked to the user account.
• Contact details, such as email address and telephone number, where used in the relevant service.
• Work-related information, such as organisation, company, role or permissions.
• Property-, forestry- or object-related information that the user works with in the application.
• Technical information such as IP address, device type, operating system and information required for operation, troubleshooting and security.
• Location data from the mobile device when functions requiring positioning are used.
• Information and content entered or submitted by the user through the application.

Only personal data required for the functions of the relevant application should be processed.

2. Location data and GPS functionality

Certain FAGUS Forest applications, including VSOP Mobil and customer-specific configurations of VSOP Mobil, use the mobile device's GPS and location services to provide GIS and map functionality.

When the user activates a GPS-based function, the application may access the device's precise geographic location.

Location information is used, among other things, to:

• display the user's current position on the map,
• follow the user's movement in the field, and
• create geographic objects and geometries based on the route or area registered by the user.

For example, the user may activate GPS positioning and move through an area. The application then uses the continuously received location information to create a geographic geometry corresponding to the route or area registered by the user.

Individual GPS positions are used during the registration process to create the geometry, but are not stored as a separate location history in VSOP. Only the completed geographic geometry is transmitted to and stored in the relevant customer's VSOP environment.

VSOP Mobil is not intended for continuous monitoring or tracking of individual users. GPS information is used to create and manage GIS data within functions actively used by the user.

Background location access

For certain GPS-based functions, VSOP Mobil may need to continue receiving location information while a registration is in progress, even when the application is temporarily not actively displayed on the screen.

This enables the application to continue creating a continuous geographic geometry during ongoing field work, for example when the user moves through a forest area.

Background location is only used in connection with functions where the user has actively started a GPS-based registration and continued positioning is necessary to perform that function.

The user can stop the GPS-based function at any time or change the application's location permissions through the device settings.

3. How location data is processed

Location data is processed only to the extent necessary to provide the application's location-based functionality.

When the user uses GPS-based registration functionality, the continuously received location is processed locally in the application to create geographic objects and geometries.

Individual GPS positions are not stored as a separate location history in VSOP. Only the completed geometry is transmitted to and stored in the relevant customer's VSOP environment.

Location data and geographic objects are not used for targeted advertising and are not sold to third parties.

If external technical services are used in connection with the processing of location data or geographic objects, this is described in the section on sharing of personal data.

4. Purposes of processing

Personal data is processed in order to:

• provide the application's functions and services,
• authenticate users and manage permissions,
• display and manage relevant map, property and work-related information,
• provide location-based functionality,
• store information entered by the user through the application,
• ensure stability, availability and security,
• troubleshoot technical issues,
• administer and develop the service, and
• comply with applicable legal obligations.

Personal data is not used for other incompatible purposes without informing the user where required.

5. Legal basis

The relevant data controller is responsible for ensuring that there is a valid legal basis for the processing of personal data carried out within the service.

Depending on how the relevant organisation uses the service, processing may, for example, be based on:

Performance of a contract

Where processing is necessary to provide a service or perform a contract.

Legitimate interests

Where processing is necessary for purposes such as security, troubleshooting, administration or development of the service, and the data controller has determined that these interests are not overridden by the interests or fundamental rights and freedoms of the data subject.

Legal obligation

Where processing is necessary for the data controller to comply with a legal obligation.

Consent

Where processing under applicable data protection legislation is based on the data subject's consent. Consent may be withdrawn.

Permissions granted by the user to the application through Android or iOS, such as permission to access the device's location, should not automatically be considered consent as the legal basis for processing under data protection legislation.

6. Sharing of personal data

In order to provide the service, CGI Sverige AB / FAGUS Forest may, on behalf of the data controller, use subprocessors and technical services necessary for the operation of the service.

These may include providers of:

• operations and hosting,
• IT infrastructure,
• authentication,
• mapping and geodata services,
• logging and technical troubleshooting, and
• support or system administration.

Such providers may only process personal data to the extent necessary to provide the relevant service and in accordance with applicable agreements and data protection requirements.

Personal data is not sold to third parties.

7. Transfers outside the EU/EEA

If personal data is processed by a provider outside the EU/EEA, the data controller and CGI Sverige AB / FAGUS Forest, where applicable, must ensure that a valid legal basis and appropriate safeguards are in place for the transfer in accordance with applicable data protection legislation.

The providers and processing activities used may vary depending on the customer environment and the technical services used.

8. Retention period

Personal data is retained only for as long as necessary for the purposes for which it is processed or for as long as required by applicable legislation.

As each customer organisation is the data controller, retention periods may vary between different organisations and different types of information.

For example:

• user account information may be retained for as long as the user has access to the service,
• operational data may be retained in accordance with the data controller's retention rules,
• technical logs may be retained for a limited period for security and troubleshooting purposes, and
• individual GPS positions used during GPS-based registration are not stored as a separate location history in VSOP. The completed geographic geometry may be retained in accordance with the data controller's retention rules.

When the data is no longer required, it should be deleted or anonymised in accordance with applicable procedures and the instructions of the data controller.

9. Information security

CGI Sverige AB / FAGUS Forest implements appropriate technical and organisational security measures to protect personal data processed within the service against unauthorised access, loss, alteration or unauthorised disclosure.

Communication between the application and backend services is protected using encrypted communication protocols where applicable.

Access to information is restricted to authorised users, systems and persons who require access in order to provide or administer the service.

10. Your rights

Depending on the circumstances, applicable data protection legislation may give you the right to:

• receive information about how your personal data is processed,
• request access to your personal data,
• request correction of inaccurate personal data,
• request deletion of personal data,
• request restriction of processing,
• object to certain processing,
• receive certain personal data in a structured and machine-readable format, and
• withdraw consent where processing is based on consent.

These rights may be restricted in certain circumstances under applicable law.

To exercise your rights, you should contact the organisation that provided the FAGUS Forest application to you and that acts as the data controller for the processing of your personal data. Contact details for the customer organisations specified in this Privacy Policy are provided above.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or another competent data protection authority.

11. Mobile device permissions

FAGUS Forest applications may request permission to access functionality on the user's device where such access is required for a specific function.

VSOP Mobil and customer-specific configurations of VSOP Mobil may, among other things, request permission for:

• precise location,
• approximate location,
• location access while the application is in use,
• background location access, and
• an Android foreground service for location functionality.

These permissions are used only for functions that require access to the relevant part of the device.

The user can change or revoke these permissions through the operating system's settings.

If a permission is denied or revoked, functions that depend on that permission may partially or completely cease to function.

12. Changes to this Privacy Policy

This Privacy Policy may be updated when FAGUS Forest applications, customer-specific configurations, the processing of personal data, or applicable legal requirements change.

The latest version of this Privacy Policy will be made available through the relevant FAGUS Forest service, application or associated website.

The date of the latest update is stated at the top of this Privacy Policy.