Terms

Privacy policy

Updated

Data controller

Wndy AB, 559299–2258, is the data controller under the EU General Data Protection Regulation (“GDPR”) for the processing of personal data for which we determine the purposes and means. Under the GDPR we are required to provide information about how we process personal data as a data controller in our operations.

If you have questions about our processing of your personal data, you can contact us at: kontakt@wndy.se

Personal data and processing of personal data

Personal data is any kind of information that directly (for example a name or a personal identity number) or indirectly can be attributed to a living natural person. Examples of information that can indirectly be attributed to a natural person are images and audio recordings processed on a computer without any names being mentioned.

Every action taken with personal data constitutes processing of personal data. Examples of common processing operations are collection, registration, organisation, structuring, storage, adaptation, transfer and erasure.

This is how we process your personal data:

  1. Processing and the purpose of the Processing: The customer registers a user account to enable the customer’s employees to log in and gain access to the Service (the customer creates an account).
    Personal data: Name, e-mail address, company name, company registration number.
    Source: Directly from the Data Subject.
    Legal basis: The legitimate interest in providing the Service under the agreement with the customer.
    Retention period: For as long as the data subject has access to a user account linked to a customer.
    Is there automated decision-making (incl. profiling)? No
    Obligation to provide personal data to us? Yes; if we are not permitted to process the personal data, we cannot act in accordance with the agreement.
    Necessary to provide personal data in order to enter into an agreement? Yes. If the personal data is not provided, we cannot enter into any agreement with you or your employer.
  2. Processing and the purpose of the Processing: Communicating in order to help customers effectively with any problems (customer support) and to provide relevant information about the Service.
    Personal data: Name, e-mail address, telephone number, company.
    Source: Directly from the Data Subject.
    Legal basis: The legitimate interest in providing the Service under the agreement with the customer and in increasing and maintaining customer satisfaction.
    Retention period: For as long as the Data Subject has access to a user account linked to a customer.
    Is there automated decision-making (incl. profiling)? No
    Obligation to provide personal data to us? No
    Necessary to provide personal data in order to enter into an agreement? No
  3. Processing and the purpose of the Processing: Marketing and information activities aimed at creating and maintaining potential customers’ interest in the Service.
    Personal data: Name, job title, e-mail address, telephone number, e-mail, company name, company registration number.
    Source: Directly from the Data Subject and sourcing from publicly available sources (LinkedIn, potential customers’ websites and so on) and from third parties.
    Legal basis: The legitimate interest in increasing sales and running our business.
    Retention period: Two years, or until the Data Subject unsubscribes from e-mail communications.
    Is there automated decision-making (incl. profiling)? No
    Obligation to provide personal data to us? No
    Necessary to provide personal data in order to enter into an agreement? No
  4. Processing and the purpose of the Processing: Marketing and information activities aimed at retaining and upgrading existing customers.
    Personal data: Name, job title, e-mail address, telephone number, e-mail, company name, company registration number.
    Source: Directly from the Data Subject.
    Legal basis: The legitimate interest in creating a long-term customer relationship in which we provide value to the customer over time.
    Retention period: For as long as the Data Subject has access to a user account linked to a customer, or until the Data Subject unsubscribes from e-mail communications.
    Is there automated decision-making (incl. profiling)? No
    Obligation to provide personal data to us? No
    Necessary to provide personal data in order to enter into an agreement? No
  5. Processing and the purpose of the Processing: Collection (sourcing) of contact details for potential customers.
    Personal data: Name, job title, e-mail address, telephone number, e-mail, company name, company registration number.
    Source: Sourcing from publicly available sources (LinkedIn, potential customers’ websites and so on) and from third parties.
    Legal basis: The legitimate interest in increasing sales and running our business.
    Retention period: Six months.
    Is there automated decision-making (incl. profiling)? No
    Obligation to provide personal data to us? No, only in the case of voluntary participation in campaigns where registration is made by the data subject themselves.
    Necessary to provide personal data in order to enter into an agreement? No
  6. Processing and the purpose of the Processing: Storing information about Data Subjects who have unsubscribed from information mailings, in order to avoid sending similar unwanted e-mails in the future.
    Personal data: E-mail address.
    Source: Directly from the Data Subject.
    Legal basis: The legitimate interest in complying with applicable law and meeting the Data Subject’s wishes.
    Retention period: Two years.
    Is there automated decision-making (incl. profiling)? No
    Obligation to provide personal data to us? No
    Necessary to provide personal data in order to enter into an agreement? No
  7. Processing and the purpose of the Processing: Compiling statistics and analyses in order to improve the Service and the user experience, and for business purposes.
    Personal data: E-mail address, IP address, browser.
    Source: Generated internally.
    Legal basis: The legitimate interest in improving and developing the Service.
    Retention period: 7 days.
    Is there automated decision-making (incl. profiling)? No
    Obligation to provide personal data to us? No
    Necessary to provide personal data in order to enter into an agreement? No
  8. Processing and the purpose of the Processing: Taking payment, invoicing and fulfilling our legal obligations under the Swedish Accounting Act.
    Personal data: Name, e-mail address, postal address, telephone number, delivery details, payment information and other similar contact details, such as invoice and delivery address.
    Source: The data subject.
    Legal basis: The legitimate interest in taking payment for the Service provided to the customer under the agreement with the customer.
    Retention period: For as long as the data subject has access to a user account linked to a customer and uses our Services.
    Is there automated decision-making (incl. profiling)? No
    Obligation to provide personal data to us? Yes, in order for us to take payment for the Service.
    Necessary to provide personal data in order to enter into an agreement? Yes. If the personal data is not provided we have no way of taking payment for the Service, and we cannot then enter into any agreement with you or your employer.
  9. Processing and the purpose of the Processing: Protecting our customers by managing and maintaining the security of our services.
    Personal data: Information about operating system, IP address, device id, locale and language settings. Support and feedback data: information you provide to us and the content of messages you send to us, such as feedback or questions, and information you provide for customer support.
    Source: The data subject and IT systems that are not publicly available.
    Legal basis: The legitimate interest in ensuring that our systems are sufficiently secure to protect our customers’ information.
    Retention period: For as long as the data subject has access to a user account linked to a customer.
    Is there automated decision-making (incl. profiling)? No
    Obligation to provide personal data to us? No
    Necessary to provide personal data in order to enter into an agreement? No

Recipients of data

Where we share information about you with others, we have ensured that those companies comply with our data protection requirements. Those companies may not use the personal data they receive for any purpose other than what has been agreed.

System and cloud providers

It may sometimes be necessary for us to share your information with external companies in order to facilitate our operations, deliver our services and fulfil our obligations. This may for example concern system and cloud providers we use to carry our work forward.

Data processors

We use suppliers that provide the following services:

  • Data storage
  • Video meetings
  • Document signing
  • Invoicing

The data processors engaged may only process personal data in accordance with the purposes and the instructions on processing and security that we have given for the processing in a data processing agreement.

Independent data controllers

We may also share your personal data with certain companies that are independent data controllers. That a company is an independent data controller means that it is not we who determine how the personal data provided to that company is to be processed. Independent data controllers with whom we may share your personal data are:

  • The police
  • Other competent authorities

When your personal data is shared with a company that is an independent data controller, that company’s privacy policy and handling of personal data applies.

Transfer of personal data to third countries

We aim to process your personal data within the EU. If we use service providers that transfer your personal data to countries outside the EU and the EEA, we will take measures to protect your data in accordance with applicable legal requirements, for example by requiring the provider to protect the data in accordance with applicable data protection rules.

Risks and security measures

Wndy uses technical and organisational security measures to protect your personal data against loss and to protect it against unauthorised access. This includes, for example, secure and private connections such as VPN, encryption, password managers, the SSL security protocol, and that access to your personal data is always limited to those employees who need access in order to perform their work. We continuously evaluate our systems, routines and policies to ensure that they are secure and protected. We regularly review login and password management and the physical security of our premises.

For more information, please contact us using the contact details at the top of this privacy policy.

What rights do you have?

You have several rights under the GDPR. If you wish to exercise your rights or have questions, you can contact us. You will find contact details at the top of this privacy policy.

Right to information

You have the right to receive information about how we process your personal data, which we give you above under the heading Personal data and processing of personal data.

More information about this right is available on the Swedish Authority for Privacy Protection (IMY) page on the right to information about how your personal data is to be handled.

Right of access

You may request confirmation of whether we process personal data concerning you and, if so, receive a copy of it — a so-called register extract — together with certain further information.

More information about this right is available on IMY’s page on the right of access.

Right to rectification

We are responsible for ensuring that the personal data we process is accurate, but if you consider that data about you is incorrect or incomplete, you have the right to request that the data be rectified.

More information about this right is available on IMY’s page on the right to have inaccurate data rectified.

Right to object

Where we process personal data on the basis of our legitimate interest, you have the right to object to the processing at any time. If we cannot demonstrate that there are legitimate grounds for continuing to process the data, we must cease the processing.

More information about this right is available on IMY’s page on the right to object.

Right to withdraw consent

If our processing of your personal data is based on your consent, you may withdraw that consent at any time by contacting us at kontakt@wndy.se. Withdrawing consent does not affect the lawfulness of the processing of your personal data carried out before the withdrawal.

More information about consent is available on IMY’s page on consent.

Right to restriction

In certain cases, for example if you have objected to the processing, you may require restriction of the processing of your personal data. By requesting a restriction you can, at least for a certain period, stop us from using the data other than, for example, to defend legal claims. You may also prevent us from erasing the data, for example if you need the data in order to claim damages.

More information about this right is available on IMY’s page on the right to restriction.

Right to erasure

In certain cases you can have your personal data erased. Where your personal data is needed for us to fulfil our assignment, comply with a legal obligation, or where we need to establish, exercise or defend legal claims, we have no possibility of erasing the data.

More information about this right, and an example of how a request may be formulated, is available on IMY’s page on the right to erasure.

Right to move your personal data (data portability)

If we process personal data about you in order to fulfil an agreement, you may in certain cases obtain your personal data in order to use it elsewhere, for example to transfer the data to another data controller.

More information about this right is available on IMY’s page on the right to move your personal data.

Comments on our processing?

If you have a question about what applies to your personal data, a request for a register extract, a complaint or a question, contact us by e-mailing kontakt@wndy.se. We answer questions within 30 days.