Privacy and cookies

Personal data to be processed

Personal Data refers to any kind of information that can be directly or indirectly related to a natural living person. The Services may include Personal Data relating to first name and surname, telephone number, address, postcode, e-mail address, social media username and personal identity number.

Sensitive Personal Data will not be processed

Sensitive Personal Data is any data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as Personal Data concerning health or a person’s sex life. Data concerning health may include, for example, information about sick leave, pregnancy and doctor’s appointments. We do not process any Sensitive Personal Data within the framework of the Services.

What do we use Personal Data for?

Open-S uses the Personal Data it collects to process consumer cases in the form of complaints, competition wins and for other contact purposes when using the contact form on the website, as well as contact via e-mail and social media. We will not disclose your Personal Data to another party without your consent, except as described in this Privacy Policy, unless we are obliged to do so in accordance with legal rules applicable at any time, and where necessary to be able to provide services, such as the transfer of a competition prize.

Information to others

Other than as described in this Privacy Policy, we will not share the Personal Data provided by you with any third party. Third party does not refer to any individual or legal person that directly or indirectly controls, is controlled by or is otherwise under the same control as the specified controller (referred to below as “Group Companies”). The relevant Group Companies that receive the Personal Data will at all times process such data in accordance with the provisions of this Privacy Policy and the legal rules applicable at any time. We will not pass on your Personal Data to third parties (excluding Group Companies) for commercial use. However, we may employ subcontractors for services related to our digital channels or the Services (“processors”). These subcontractors may process Personal Data and may require some access to Personal Data collected via the digital channels or the Services, e.g. cloud service providers responsible for storing Personal Data. We will always restrict the access of subcontractors to the Personal Data needed to enable us to offer you access to our digital channels or the Services. We will also require these subscontractors to (i) protect your Personal Data in accordance with this Privacy Policy and (ii) not use or disclose this Personal Data for any purpose other than providing us with agreed products or services so that we in turn will be able to provide you with access to our digital channels or the Services.

Transfers to a third country

We will not transfer Personal Data to a third country (i.e. a non-EU/EEA country).

Consent

When you accept this Privacy Policy, you consent to us using and processing your Personal Data in accordance with terms in this policy. You also agree to us using cookies and other similar technologies (see also the separate cookie policy). If you do not accept the terms of this Privacy Policy, please do not use the digital channels or the Services. You may withdraw your consent at any time without this affecting the legality of the processing which took place on the basis of the consent you gave before you withdrew it.

Changes to the Privacy Policy

If we change the Privacy Policy, we will advise you accordingly when you use the Services and/or otherwise on the digital channels.

Erasure of data

Your Personal Data will not be retained for longer than is necessary for the purposes of the processing and in general we will erase Personal Data in the manner laid out in the legal rules applicable at the time.

Right to request information

You have the right to request, free of charge, information about what (if any) Personal Data we process about you (known as a “register extract”) and to have any inaccurate data rectified. If you would like to know if we process Personal Data about you, you can send us a signed written request (see contact details below). When you submit your request, you need to specify exactly what data you are interested in (unless you are interested in all the data), e.g. contract documents, customer service correspondence or similar. In this way, we can provide you with the information that is relevant to you. If you submit multiple requests for register extracts, we may charge a fee or, in some statutory cases, refuse to act on your request. The register extract will be sent to you within 30 days of receiving the request. If the extract is extensive enough that we need more time or if, for any reason, we are unable to fulfil your request, we will let you know.

Right to rectification

In order to fulfil our obligations with regard to always maintaining accurate and relevant Personal Data, we systematically work on our records and update the Personal Data where necessary. If you notice that the data we have about you is inaccurate or if we lack important information, you have the right to have your data rectified. We normally rectify simple data without deliberation, but in other cases we may need to consider your request. We will not accept your request if it is impossible or requires a large amount of effort. If you request it, we will also inform you about the recipients to whom the rectification has been disclosed. If your Personal Data is changed at your request, we will inform any subcontractors and partners to whom we have disclosed the data about the updated data.

Right to be forgotten

We store your Personal Data for as long as you remain our customer or for as long as we otherwise need to store it in order to fulfil our obligations to you, or otherwise under applicable law. The data will then be erased. You have the right to request that we erase your Personal Data if:

• it is no longer needed for the purposes for which it was collected and for which we process it;
• we process Personal Data on the basis of your consent and you withdraw this;
• we process Personal Data for direct marketing purposes and you object to the Personal Data continuing to be processed for this purpose; we process Personal Data based on a balance of interests and there are no legitimate reasons that override your interest;
• we do not process Personal Data in accordance with the applicable rules;
• Personal Data is required to be erased in order to comply with a legal obligation.
  However, we have the right not to erase your Personal Data if we need to retain it in order to fulfil a legal obligation or other obligation to you. When we receive your request, we will assess whether or not there are grounds to delete your Personal Data. You will then be notified of our assessment. If we erase your data at your request, we will inform any subcontractors and partners who we have provided the data to that the data has been erased. However, we will not do this if it is impossible or requires a large amount of effort.

Right to object

You have the right to object to our processing of your Personal Data that we undertake on the basis of a so-called balancing of interests in accordance with the law. In this case, you need to specify in writing what processing you object to. In the event of any such objection, we can only continue to carry out the processing if we can demonstrate that there are compelling legitimate grounds for processing the personal data that outride your interests. However, if your Personal Data is processed for direct marketing purposes, you always have the right to object to the processing at any time.

Right to restriction of processing

• You have the right to request that our processing of your Personal Data be restricted in the following circumstances:
• When you have contested the accuracy of the Personal Data for a period that enables us to verify the accuracy of the Personal Data;
• When the processing is unlawful and you oppose the Personal Data being erased and instead request a restriction on its use;
• When we no longer need the Personal Data for the purposes of the processing but you need it in order to establish, exercise or defend legal claims;
• When you have objected to processing in accordance with paragraph 13 pending verification of whether or not our legitimate grounds override your legitimate grounds.

Restriction means that the Personal Data will be marked so that in future it can only be processed for certain defined purposes.

Right to data portability

If you have provided us with your Personal Data, you have the right in some cases to receive and take your Personal Data with you in order, for example, to transfer it to another company. In order for you to use your right to data portability, your request must relate to Personal Data that you have provided us with and that we process on the basis of your consent or to fulfil a contract we have with you. The right to data portability does not apply when our processing of your Personal Data is based on a balancing of interests or a legal obligation.

The right to complain

If you have any complaints or objections regarding our handling of your Personal Data, please contact us in the first instance so that we can help you in the best way possible. However, you always have the right to submit your complaint directly to the supervisory authority, the Swedish Data Protection Authority.

Security

We take all appropriate technical and organisational security measures necessary to protect Personal Data against unauthorised access, alteration or destruction.

Contact details

If you wish to submit a request in accordance with your rights above, such requests must be made in writing and be sent to us at the address below. If you have any questions about this policy or our personal data processing, you can contact us at: info@opens.org

NB: As it is important that we do not disclose your Personal Data to anyone else, a written request must be made in writing and be signed by you. With your request, you must also send a signed copy of a valid ID document (a passport or driver’s licence).