Privacy notice

Different parties decide different things about your data. The roles depend on the purpose of the processing, not only on who runs the service.

We only process data the service needs:

To create an account and book you must provide:

• Your name and a confirmed email address
• Payment or invoice details, depending on how you pay

If you do not provide this information you cannot create an account or complete a booking. Messages and notes on a booking are optional.

You provide most of the data yourself. We also receive data from:

• BankID (via Idura): name, personal identity number and a date of birth we derive from the number
• Auth0, when you log in with a password: your email address
• Administrators or representatives at Arboga kommun or an association, who can register information about you, such as your role, your membership or that you take part in an activity
• Case workers, who can add decisions, messages and other information to grant applications

Information entered by an administrator or case worker therefore does not come from you. You can ask Arboga kommun for a copy and for rectification.

We do not obtain data about you from external registers.

• Receive, confirm and manage your bookings
• Take payments and make refunds
• Send confirmations, reminders and notices of changes
• Report on the activity when the law or a grant provider requires it, e.g. LOK support
• Keep the service secure and working

The legal basis depends on the purpose. Each purpose below has its own basis, and the bases are not interchangeable. The processing does not rely on consent, so there is no consent to withdraw.

Where it says that Arboga kommun decides the basis, you can ask the organisation which one applies.

If you identify yourself with BankID, we receive your name and your full personal identity number from the e-ID, via Idura. We derive your date of birth from the number.

The personal identity number and date of birth are stored in your account on the platform. They are not deleted automatically. You can ask Arboga kommun to delete them, subject to the limits described under “Your rights”.

The number is not in your login cookie, is never shown in the service and is removed from the change log. No other part of the platform reads it, and we do not disclose it to others without legal grounds.

The service performs automatic eligibility checks, for example of age, login level or other booking conditions, which can prevent a booking. An unpaid booking is also released automatically when the payment time runs out. We do not use automated processing to make decisions based solely on automated processing that have legal effects on you or similarly significantly affect you. We do not use profiling for this purpose.

We never sell personal data. Data is only shared with:

• Administrators at Arboga kommun, to the extent their duties require
• Folke and its sub-processors for hosting, login and payments
• Authorities and grant providers when the law or grant conditions require

Access is role-based, and all technical access by the platform supplier is logged.

The service runs in data centres within the EU/EEA. Some sub-processors, e.g. for login and card payments, are companies based outside the EU/EEA. When data is transferred there, it is protected by safeguards under Chapter V of the GDPR, such as the European Commission's standard contractual clauses.

How long data is kept depends on its purpose. The platform's own time limits are listed below. Where no time is stated, data is kept only for as long as it is needed for the purpose it was collected for.

• Account details are kept for as long as you have an account and as long as they are needed for bookings you have made
• Bookings and orders are kept for as long as they are needed to manage and follow up the activity and for the organisation's own obligations
• Payment and invoice information is kept for as long as the organisation needs it for its accounting and legal obligations. The platform is not the organisation's accounting archive
• Logs of events are kept for as long as needed for security, troubleshooting and traceability of changes
• Logins end after 7 days without activity, and at the latest after 30 days
• Deleted data may remain in backups for up to 7 days

Where no time is stated above, data is kept for as long as it is needed for the purpose and for the organisation’s legal requirements, such as bookkeeping. Accounts, bookings, payment details and logs are currently not deleted automatically. If you want your data deleted, contact Arboga kommun.

The service only uses necessary cookies, for login and language choice. No cookies are used for marketing.

You have rights over your personal data. Contact Arboga kommun to use them, as the service currently has no function for deleting or exporting your data yourself. You will get an answer within one month, and in some cases later.

• Access – you have the right to know whether we process data about you and to get a copy, subject to the limits in the GDPR, for example when a copy would reveal someone else’s data.
• Rectification – you have the right to have incorrect data corrected. You can change some profile details yourself under your profile.
• Erasure – you have the right to request deletion. Data must still be kept where the law requires it, for example under the Bookkeeping Act and, for public bodies, the archive rules and the principle of public access to official records.
• Restriction – you have the right to request that processing is restricted in the situations the GDPR specifies, for example while the accuracy of data is checked.
• Data portability – you have the right to receive the data you provided yourself in a machine-readable format, but only where the processing is based on contract or consent.
• Objection – you have the right to object to processing based on public interest (6.1 e) or legitimate interest (6.1 f). The processing may then only continue if there are compelling legitimate grounds that override your interests, or it is needed for legal claims.
• Consent – the processing described here does not rely on consent, so there is no consent to withdraw.

If you believe the processing breaches the GDPR, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

This notice may be updated. The date at the top shows when it last changed, and significant changes are announced in the service.