The purpose of this policy is to inform you how we process your personal data.

If you complete our idea submission form

The personal data you provide in the form will be used both to enable us to discuss your idea and to send you relevant information about our activities. The personal data collected includes your first name, surname, email address, and any optional text you choose to provide.

The legal basis for this processing is a legitimate interests assessment, where we have determined that our (and your) interest in handling and responding to your submission outweighs any potential impact on your privacy. For the purpose of discussing your idea, we will retain your data for as long as the dialogue is ongoing (see below for how data is handled if your idea is developed further within our activities). For the purpose of sending relevant information, we will retain your data until you notify us that you no longer wish to receive such communications. You have the right to object to processing based on legitimate interests at any time (see section “Your rights”).

If you are a contact person for a partner organisation

We collaborate on an ongoing basis with organisations across various sectors. If we have identified you or your employer as an existing or potential partner, we process your name, email address, telephone number and role in order to contact you and maintain a dialogue.

This information may have been collected via websites, meetings, trade fairs, training events or from other organisations. The processing is based on our legitimate interest in developing and communicating about our activities with partners. Personal data is retained for as long as there is a need for contact between the organisations or until a contact person is replaced. You have the right to object to processing based on legitimate interests (see section “Your rights”).

If you participate in our democracy labs or workshops

We collect personal data if you participate in our democracy labs or other types of workshops. The data collected may include your name, role, telephone number, email address and photographs. Additional personal data may also be processed if it appears in materials, ideas or other content shared within the activity.
 
Processing is based on a legitimate interests assessment, where the legitimate interest is to administer our democracy labs and workshops. We will retain your data for this purpose until you inform us that you no longer wish to be contacted. You have the right to object to such processing (see section “Your rights”).

In some cases, certain data may be processed on the basis of a contract. In such cases, the retention period and scope will be specified in the relevant agreement.

If you participate in our other activities

We may collect your contact details if you participate in other activities such as exhibitions, lectures, debates or media training. The personal data collected may include your name, role, email address and telephone number.
 
Processing is based on our legitimate interest in administering activities and communicating about our work. We will retain your data until you notify us that you no longer wish to be contacted. You have the right to object to such processing (see section “Your rights”).

If you interact with us on social media

We are active on social media platforms. If you choose to publish content, such as posts or comments, on our public pages, you consent to our processing of the personal data you provide.

We process this data in order to communicate and engage with individuals who contact us. In addition to being stored on the platform itself, we may read, respond to and, in exceptional cases, delete such content. You may withdraw your consent at any time by deleting your content.

Please note that by publishing content on our pages, you also provide your data to the platform provider. We have no control over how these providers process your data; this is governed by their own terms and conditions.

If you send us an email

Incoming emails generally contain personal data. If you contact us by email, we will process your personal data by reading, storing and handling your message, and where appropriate forwarding it to the relevant recipient within our organisation.

The personal data processed includes the information you provide, typically name, email address, telephone number and job title.

Processing is based on a legitimate interests assessment, where we consider that our (and your) interest in handling and responding to your email outweighs any potential impact on your privacy. You have the right to object to such processing (see section “Your rights”).

Please consider carefully before including personal data about other individuals in your email. While such data may be processed based on legitimate interests, it may be difficult or impossible for us to inform those individuals. Only include such information where necessary.

Recipients of personal data

Where personal data is processed for the purposes described in this policy, it may be shared with our suppliers (such as system providers) and/or partners where necessary to fulfil those purposes. We have entered into data processing agreements with such parties to ensure that they only process personal data in accordance with our instructions.

Your rights

As a data subject, you have certain rights under the Data Protection Regulation (dataskyddsförordningen). Below we describe these rights and how we work to fulfill these rights.

Right of access

You have the right to request confirmation as to whether we process your personal data and, if so, to access that data and information about how it is used. You also have the right to request a copy.

The first copy is free of charge; additional copies may incur a fee. Where possible, information will be provided in electronic form. Access may be restricted where disclosure would adversely affect the rights and freedoms of others.

Right to rectification

You have the right to have inaccurate personal data corrected without undue delay and to have incomplete data completed.

Right to restriction of processing

You have the right to request restriction of processing in certain circumstances, including:

• where you contest the accuracy of the data
• where processing is unlawful but you oppose erasure
• where we no longer need the data but you require it for legal claims
• where you have objected to processing pending verification 

During restriction, data may only be processed with your consent or for specific legal reasons.

Right to erasure

You have the right to request deletion of your personal data where:

• the data is no longer necessary
• you withdraw consent and no other legal basis applies
• you object and there are no overriding legitimate grounds
• the data has been processed unlawfully
• erasure is required by law

This right is not absolute and may be limited where processing is necessary, for example, for legal obligations or the defence of legal claims.

Right to compensation

If you suffer damage as a result of unlawful processing, you may be entitled to compensation.

Right to lodge a complaint

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

Right to object

You have the right to object to processing based on legitimate interests or public interest. We will then assess whether our interests override yours.

Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time. This will not affect the lawfulness of processing carried out prior to withdrawal.

Right to data portability

Where processing is automated and based on consent or contract, you have the right to receive your personal data in a structured, commonly used and machine-readable format and, where technically feasible, to have it transferred to another controller.

General

If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse the request.
 
For more information about your rights, please visit:
www.imy.se/privatperson/dataskydd/dina-rattigheter/

Contact

The data controller for the processing described above is:

Erna Gruppen AB
Company registration number: 556024-5812
Våxnäsgatan 20
653 40 Karlstad, Sweden
 
If you have any questions about how we process your personal data, or wish to exercise your rights, please contact: gdpr@ernagruppen.se.