INFORMATION REGARDING PROCESSING OF PERSONAL DATA
For www.thedearlydeported.org, the protection of human rights is more important than anything else. This includes the protection of individuals’ integrity and personal data, which is governed by the so-called “General Data Protection Regulation”. We have elected to be transparent as to the manner in which we process personal data, e.g. in respect of our members, donors and subscribers to our newsletter. Naturally, we do so in accordance with the rules of the General Data Protection Regulation. Below, you can read how we process the personal data of various individuals, why we do so, for what period of time, and with whom we might share the personal data. www.thedearlydeported.org, is the data controller for the processing of personal data described below. All processing of personal data and marketing carried out by us takes place in accordance with the Swedish Fundraising Council’s guidelines.
WHEN WE GATHER PERSONAL DATA AND THE PERSONAL DATA WE GATHER
We gather and process your personal data in several situations, such as (i) when you make a donation to us or become a member, (ii) when you subscribe to our newsletter or sign up for one of our events, (iii) when you apply for a job or internship with us, and (iv) when we find you interesting because we think you can contribute to our activities. The information we gather normally consists of contact information such as names, telephone numbers, addresses and/or e-mail addresses. In certain cases, it also includes your title and the organisation represented by you. Depending on the purpose to be fulfilled, however, other personal data may be necessary, e.g. your personal identification number and bank account number if you make regular contributions to us via autogiro, your professional experience when you apply for a job with us or the type of business you conduct if you are a potential donor. In such case, we may also obtain information from publicly available sources. In situations where we gather personal data directly from you, i.e. when you choose to become a member, make a donation, subscribe to our newsletter, sign up for one of our events or apply for a job with us, we will tell you which information is mandatory in order for us to be able to fulfil our part of the agreement, e.g. to send a newsletter to you.
WHY WE PROCESS PERSONAL DATA, FOR WHAT PERIOD OF TIME, AND OUR LEGAL BASIS FOR THE PROCESSING
The processing of personal data is permissible only where there is a specific purpose for the processing and an applicable so-called “legal basis”. Furthermore, processing of personal data is permissible only during a limited period of time. www.thedearlydeported.org will only process your personal data for the purposes set forth below and at no time for any purpose which is otherwise incompatible with those purposes. Furthermore, we will only process personal data for the period of time set described below. Please note that we may be compelled to deviate from the time limits in the table in cases in which we must process your personal data in order to comply with, or demonstrate that we comply with, applicable legislation, e.g. the Swedish Accounting Act. In such cases, however, we will only process your personal data to the extent such laws so require or make it necessary for us to do so.
PROCESSING STORAGE TIME LEGAL BASIS
If you become a survey respondent of www.thedearlydeported.org, we will process your personal data to keep a record of our members and to communicate with you. We will process your personal data until you decide to terminate your membership. After that, we will erase your personal data within 1 year. Processing is necessary in order for us to be able to fulfil our agreement with you (i.e. maintain the membership).
If you make a regular (e.g. monthly) donation to www.thedearlydeported.org or have made a donation to us at any time, you are registered with us in order for us to make it possible for you to make payments, to maintain our relationship with you, and to send information to you regarding our operations, e.g. our annual report. We retain your personal data for three years after you have made your last donation to us. However, you can unsubscribe to our send-outs at any time. In conjunction with regular donations, processing is necessary in order for us to fulfil our agreement with you (i.e. make it possible for the same amount to be withdrawn from the same account, e.g. every month) and that we can see to our legitimate interest in collecting additional contributions for our activities. If you have made a donation on one or more separate occasions, all processing is based on our legitimate interest.
If you subscribe to our newsletter, we will obtain your e-mail address in order to be able to send the newsletter to you. You can unsubscribe at any time by using a link in the newsletter. We will process your personal data until such time as you unsubscribe from our newsletter. Processing is necessary in order for us to be able to fulfil our agreement with you (i.e. provide the newsletter requested by you). Events. If you have signed up for one of our events, we will process your personal data in order to make your participation possible. This may include sensitive personal data, e.g. if you state that you require special assistance because you use a wheelchair. We will process your information until the event is held. Thereafter, we might contact you because we regard you as a potential donor but, if you do not make a donation, we will remove you from our register after a period of not more than six months. The processing is necessary in order for us to be able to fulfil our agreement with you (i.e. arrange the event you wish to attend). To the extent we collect sensitive personal data, we will gather your explicit consent. As regards our subsequent processing, kindly refer to “Send-outs and contacts within the context of our fundraising work” and “Sendouts within the context of our advocacy work”.
In the event you apply for a job or internship with us, we will process your personal data, i.e. the information provided in your documents, in order to determine whether we will employ you. We will retain your application until the employment process is concluded. The processing is necessary in order for us to be able to fulfil our agreement with you (i.e. process your application).
PROCESSING STORAGE TIME LEGAL BASIS
is by means of send-outs to and contacts with persons we regard as potential donors. This may for example be relevant to persons we have encountered in the course of our activities and media monitoring or who appear in the registers we have ordered. you do not respond, your personal data will be erased after not more than three months following our first send-out or contact. If you choose to make a donation to us, we will process your personal data in accordance with the above. Send-outs within the context of our advocacy work. Our work involves contacting journalists, politicians and others we believe can benefit the protection of Diversity & Inclusion in the world. If you are in such a position, you may accordingly be contacted by us. For example, this may consist of an invitation from us for you to join an event or information regarding current events in our operations. We may adapt our send-out to you, e.g. depending on your profession or where you are geographically located. If you do not wish to receive our send-outs, you can object at any time. We will retain your personal data so long as we believe you should receive it or until such time as you state that you no longer wish to be contacted by us. The processing is necessary in order for us to be able to see to our legitimate interest in conducting advocacy work for protecting human rights.
If you work for a supplier, partner organization or another company or organization that works with www.thedearlydeported.org and you are the designated contact person, we will process your personal data to keep in touch with you in business related matters. You may object at any time. We will retain your personal data for as long as we cooperate with your company or organization and delete your personal data within 6 months after such cooperation ceases. The processing is necessary in order for us to be able to remain in contact with our business partners. We also analyse visitor statistics and visitor behaviour on our website, but this is done in respect of anonymised data and on an aggregated level, which means that we will at no time track any individual visitor’s behaviour.
SHARING YOUR PERSONAL DATA
Only persons who need your personal data in order for us to be able to fulfil the purposes set forth above will have access to it. However, we may need to share personal data with third parties in order to achieve such purposes. Normally, these third parties process personal data on behalf of us as so called “data processors”, e.g. by providing storage services, marketing services or IT systems. The aforementioned sharing may entail that your personal data is transferred outside the EU/EEA. In the event this occurs, it will be in accordance with applicable data protection rules and will normally be based on the EU Commission’s standard model clauses for such transfers. You may find them here. In the event we transfer personal data to the U.S., this will be based on the “EU-U.S. Privacy Shield” provided that the recipient is certified.
YOUR RIGHTS IN ACCORDANCE WITH THE GDPR
If you have any questions regarding our processing of your personal data, you should direct them to firstname.lastname@example.org. You may also use the contact information at the bottom of this document. This contact information may be further used if you desire to exercise any of your rights in accordance with the General Data Protection Regulation. Please note that these rights are not absolute, and a request to exercise such right will not always result in any action. Your rights according to the General Data Protection Regulation include: • Right to access – According to Article 15 of the General Data Protection Regulation, a data subject is entitled to access to his or her personal data and certain information concerning the processing thereof. That information is presented in this document. • Right to rectification – According to Article 16 of the General Data Protection Regulation, a data subject is entitled to rectification of incorrect information and completion of incomplete personal data. • Right to erasure – Under certain circumstances, a data subject in accordance with Article 17 of the General Data Protection Regulation is entitled to the erasure of his or her personal data. This is the so-called “right to be forgotten”. • Right to restrict processing – Under certain circumstances, data subjects are in accordance with Article 18 of the General Data Protection Regulation entitled to restrict processing by the data controller. • Right to data portability – According to Article 20 of the General Data Protection Regulation, data subjects are entitled to obtain their personal data (or have them transferred to another data controller) in a structured, commonly used and machine-readable format. • Right to object – According to Article 21 of the General Data Protection Regulation, a data subject is entitled to object to particular personal data processing, e.g. all processing based on www.thedearlydeported.org’ legitimate interests. Finally, all registered individuals are entitled to lodge a protest with the supervisory authority which, in Sweden, is the Swedish Data Protection Authority.
No personal data is saved since this is done in respect of anonymised data and on an aggregated level, which means that we will at no time track any individual visitor’s behaviour. With the exception of Google, Facebook, Instagram, and Typography (survey tool) whose tools we use, www.thedearlydeported.org does not share this information with third parties.
In order to ensure that your personal data is secure with us, www.thedearlydeported.org has implemented technical and organisational security measures in order to protect your personal data from, for example, unintentional erasure or impermissible access. These measures include firewalls, traceability, limitations on access and crisis management routines as well as organisational routines pertaining to the manner in which employees will act in their professional roles.
CONTACT INFORMATION Please use the following contact information if you wish to contact us. E-mail: email@example.com