PLEASE NOTE THAT THE ORIGINAL AND OFFICIAL VERSION OF THIS POLICY IS WRITTEN IN SWEDISH. THIS IS NOT TO BE CONSIDERED AS AN OFFICIAL TRANSLATION.

The GDPR, or the Data Protection Regulation, is a law that applies across the EU from May 25, 2018. It aims to give us all greater control over how data about us is handled and increase the security of how our personal data is processed. Personal data is any information that can be directly or indirectly linked to an individual.

 

We at the Rainbow Heart Foundation think it is important that you feel safe about how your personal information will be used if you submit it to us. This information is intended to explain how Rainbow Heart handles your personal information. In order for you to know how we handle your personal data, it is important that you read the policy. If you have any questions about how your personal information is handled, you are always welcome to contact us. Contact information can be found below.

 

Data controller

The Rainbow Heart Foundation is responsible for the personal data processed in connection with the contacts between you and us. Contact information for the foundation is as follows:

C/O Ström
Sickla strand 9
131 34 Nacka
philip@regnbagshjartan.se

 

What personal information do we process?

Here are some examples of personal data that we process:

• Name

• Email address

• Address

• Telephone number

 

When do we process your personal information and how do we collect it?

We collect your personal information in the following cases:

• When you sign up for our electronic newsletter

• When you contact us, eg. via contact form or email

• When you participate in petitions

• When buying something in our shop

 

For example, we collect personal information in the following ways:

• Information that you provide directly

• Information recorded when visiting our website

• Information that you self-register and provide voluntarily

 

Purpose and legal basis for processing

There must always be a legal basis for the data we process. Rainbow Heart uses the information you provide to us in order for us to be able to fulfill our obligations to you and / or to carry out other obligations for you. Our starting point is not to process more personal information than is necessary for the purpose, and we always strive to use the least privacy-sensitive information.

 

Here is a description of the legal basis we apply to the most common cases of personal data processing:

• Subscribe to our newsletter - we rely on legitimate interest because the treatment is necessary for the purpose in question

• Petition - we obtain consent

• Buying something in our shop - fulfillment of an agreement

 

Retention of data

Rainbow Hearts only saves your personal information as long as we believe it is necessary to fulfill what was the purpose when we collected them, or as long as we have to store them by law. After that, your information will be deleted or alternatively we will de-identify your personal data so that they can no longer be linked to you. We have internal routines to ensure this.

 

Your rights

You have the right to receive information about the processing of personal data. You also have the right to have your personal data corrected, to have the data deleted, to require that the processing of data in certain cases be restricted, and in some cases to object to processing.

 

How do I refuse direct marketing?

Rainbow Hearts can use your direct marketing email address. If you do not want us to use your direct marketing email address, you are welcome to contact us in order to enable a so-called advertising barrier for your information, and your information is deregistered from the mailing list. Please note that newsletters are also considered as direct marketing.

 

Third-party recipients of data

Our starting point is that your personal data should not be disclosed to third parties unless it is necessary to fulfill our obligations under contract or law. In cases where we disclose personal data to third parties, we establish confidentiality agreements / processor agreements and ensure that personal data are processed in a satisfactory manner.

 

The right to lodge a complaint

You have the right to submit a complaint to the Datainspektionen regarding our processing of your personal data.

 

Transmission of data to third countries

We always strive to keep personal data within the EU / EEA, but in rare cases we use processors who store and process personal data in countries outside the European Union. In that case, we ensure that personal data is processed in a satisfactory manner. If we use processors transferring data to countries we ensure that those have an adequate level of protection and that this is done in accordance with SCC 2010/87 /EU.